CVE-2026-100504: Out-of-bounds Write in NationalSecurityAgency ghidra
Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled, corrupting memory and potentially achieving code execution.
AI Analysis
Technical Summary
CVE-2026-100504 describes a stack-based out-of-bounds write vulnerability in the National Security Agency's Ghidra software, specifically in the decompiler's leftshift128 function. The flaw is triggered by malicious binaries containing specific instruction sequences with negative shift amounts in p-code. When these binaries are decompiled, the vulnerability causes memory corruption on the stack, which could lead to code execution. This affects Ghidra versions from 0 up to and including 12.1.4.
Potential Impact
Successful exploitation can corrupt memory on the stack during decompilation, potentially allowing an attacker to execute arbitrary code with the privileges of the user running Ghidra. This could compromise the integrity and security of the analysis environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid decompiling untrusted binaries or use alternative analysis tools. Monitor vendor channels for updates and apply patches promptly once released.
CVE-2026-100504: Out-of-bounds Write in NationalSecurityAgency ghidra
Description
Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled, corrupting memory and potentially achieving code execution.
CVSS v4.0
Score 7.3high
Affected software
NationalSecurityAgency
ghidra
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-100504 describes a stack-based out-of-bounds write vulnerability in the National Security Agency's Ghidra software, specifically in the decompiler's leftshift128 function. The flaw is triggered by malicious binaries containing specific instruction sequences with negative shift amounts in p-code. When these binaries are decompiled, the vulnerability causes memory corruption on the stack, which could lead to code execution. This affects Ghidra versions from 0 up to and including 12.1.4.
Potential Impact
Successful exploitation can corrupt memory on the stack during decompilation, potentially allowing an attacker to execute arbitrary code with the privileges of the user running Ghidra. This could compromise the integrity and security of the analysis environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid decompiling untrusted binaries or use alternative analysis tools. Monitor vendor channels for updates and apply patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-25T22:14:36.046Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab71d5ef7a7c541069a3375
Added to database: 09/26/2026, 01:18:22 UTC
Last enriched: 09/26/2026, 01:32:42 UTC
Last updated: 09/26/2026, 02:27:33 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.