CVE-2026-116012: Numeric Truncation Error in NationalSecurityAgency ghidra
Affects NationalSecurityAgency ghidraSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| NationalSecurityAgencyghidra | Affected
| Fixed in
|
GitHub Actionsghidrapkg:github/ghidraOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
No vendor advisory or patch information is provided. Until a fix is available, avoid processing untrusted or suspicious .sla files with affected Ghidra versions.
Description
Ghidra versions prior to 12.2 contain a numeric truncation vulnerability in the PackedDecode::skipAttribute and skipAttributeRemaining functions. This flaw arises from storing 64-bit string lengths in 32-bit variables, which can be triggered by a crafted packed stream such as a malicious .sla file. Exploitation may allow injection of attributes into the decompiler's input or cause the decompiler process to crash. The vulnerability has a low CVSS score and does not indicate critical impact or widespread exploitation.
Impact
The vulnerability may lead to injection of attributes into the decompiler input or cause the decompiler process to crash, potentially disrupting analysis workflows. The CVSS score of 2 indicates low severity, with limited impact and no known exploits in the wild. There is no indication of privilege escalation or remote code execution.
Summary
CVE-2026-116012 is a numeric truncation vulnerability in NationalSecurityAgency's Ghidra software before version 12.2. The issue exists in the PackedDecode::skipAttribute and skipAttributeRemaining functions within marshal.cc, where 64-bit string lengths are improperly stored in 32-bit variables. An attacker can supply a specially crafted packed stream (e.g., a malicious .sla file) to exploit this flaw, potentially injecting attributes into the decompiler's input or causing a crash of the decompiler process.
References
- github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v423-5vh7-c7jw (opens in a new tab)
- github.com/NationalSecurityAgency/ghidra/commit/d105789b331dba84ad73ab92db890e38fe665be0 (opens in a new tab)
- github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build (opens in a new tab)
- github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Decompiler/src/decompile/cpp/marshal.cc (opens in a new tab)
- vulncheck.com/advisories/ghidra-before-12.2-integer-truncation-in-packeddecode-skipattribute-decompiler-parser (opens in a new tab)