CVE-2026-49496 is a heap-use-after-free vulnerability in Ghidra before version 12.1. It occurs in the SleighBuilder::generatePointerAdd function due to iterator invalidation caused by reallocation of the issued vector in PcodeCacher::allocateInstruction. This memory corruption vulnerability can be exploited by processing malicious binaries through the public Sleigh::oneInstruction C++ API, affecting downstream consumers of the SLEIGH library. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. There is no vendor advisory or patch information available at this time.

Successful exploitation can lead to memory corruption when decompiling malicious binaries, which may cause crashes or potentially allow further exploitation depending on the context. The vulnerability affects local attack vectors with low complexity and requires user interaction. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when decompiling untrusted binaries using the Sleigh::oneInstruction API and consider restricting usage to trusted inputs only.