CVE-2026-49496: Ghidra < 12.1 - Heap-Use-After-Free in SleighBuilder::generatePointerAdd via Vector Reallocation
Ghidra before 12.1 contains a heap-use-after-free vulnerability in SleighBuilder::generatePointerAdd caused by iterator invalidation when PcodeCacher::allocateInstruction reallocates the issued vector. Attackers can trigger memory corruption by decompiling malicious binaries through the public Sleigh::oneInstruction C++ API, affecting downstream SLEIGH library consumers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghidrato a version that resolves this vulnerability.Fixed in 12.1 - Compensating control
Do not decompile untrusted or malicious binaries using the public Sleigh::oneInstruction C++ API. If decompilation of untrusted inputs is required, perform it only in a sandboxed or isolated environment and restrict access to the API to trusted users/processes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49496?
CVE-2026-49496 has a medium severity rating of 6.9.
How do I fix CVE-2026-49496?
The vulnerability CVE-2026-49496 can be fixed by applying the available patch for Ghidra version 12.1 or later.
What types of attacks can exploit CVE-2026-49496?
CVE-2026-49496 can be exploited through memory corruption triggered by decompiling malicious binaries.
What software is affected by CVE-2026-49496?
CVE-2026-49496 affects Ghidra software versions prior to 12.1.
What is the nature of the vulnerability in CVE-2026-49496?
CVE-2026-49496 is a heap-use-after-free vulnerability caused by iterator invalidation during vector reallocation.