CVE-2026-49496 is a heap-use-after-free vulnerability in Ghidra before version 12.1, specifically in the SleighBuilder::generatePointerAdd function. The root cause is iterator invalidation caused by the reallocation of the issued vector in PcodeCacher::allocateInstruction. This can lead to memory corruption when malicious binaries are decompiled using the public Sleigh::oneInstruction C++ API, affecting downstream consumers of the SLEIGH library. The vulnerability has not been reported as exploited in the wild and no official remediation or patch is currently documented.

Successful exploitation can cause memory corruption, potentially leading to application crashes or undefined behavior when processing malicious binaries. The vulnerability requires local access with user interaction (decompiling a crafted binary) and does not allow privilege escalation or network-based exploitation. The impact is rated medium with a CVSS score of 6.9.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when decompiling untrusted binaries and consider limiting access to the vulnerable API. Monitor official National Security Agency or Ghidra project advisories for updates on patches or mitigations.