CVE-2026-100503

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-100503
Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines.

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/NationalSecurityAgency/ghidra Product
https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/merge.cc#L462-L472 Patch
https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/subflow.cc#L2717-L2745 Patch
https://github.com/NationalSecurityAgency/ghidra/commit/5ef1ee4d7a25a65db195f3a70f681ca74440be61 Patch
https://www.vulncheck.com/advisories/ghidra-through-12.1.4-heap-use-after-free-in-decompiler Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*
History

08 Oct 2026, 16:43

Type Values Removed Values Added
CPE cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*
References () https://github.com/NationalSecurityAgency/ghidra - () https://github.com/NationalSecurityAgency/ghidra - Product
References () https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/merge.cc#L462-L472 - () https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/merge.cc#L462-L472 - Patch
References () https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/subflow.cc#L2717-L2745 - () https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/subflow.cc#L2717-L2745 - Patch
References () https://github.com/NationalSecurityAgency/ghidra/commit/5ef1ee4d7a25a65db195f3a70f681ca74440be61 - () https://github.com/NationalSecurityAgency/ghidra/commit/5ef1ee4d7a25a65db195f3a70f681ca74440be61 - Patch
References () https://www.vulncheck.com/advisories/ghidra-through-12.1.4-heap-use-after-free-in-decompiler - () https://www.vulncheck.com/advisories/ghidra-through-12.1.4-heap-use-after-free-in-decompiler - Patch, Third Party Advisory
First Time Nsa ghidra
Nsa

26 Sep 2026, 01:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-09-26 01:16

Updated : 2026-10-08 16:43

NVD link : CVE-2026-100503

Mitre link : CVE-2026-100503

CVE.ORG link : CVE-2026-100503

JSON object : View

Products Affected

nsa

  • ghidra
CWE
CWE-416

Use After Free