CVE-2026-49497 is a path traversal vulnerability in the National Security Agency's Ghidra software before version 12.1. The issue exists in the SameDirDebugInfoProvider, which does not properly validate filenames obtained from the .gnu_debuglink sections of ELF binaries. An attacker can craft malicious ELF binaries containing directory traversal sequences to cause Ghidra to access files outside the intended directory scope. This can be exploited during automatic DWARF debug information analysis to probe for the existence of files on the filesystem and leak CRC32 hashes of arbitrary files. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker can use specially crafted ELF binaries to cause Ghidra to access and leak information about arbitrary files on the host filesystem, specifically CRC32 hashes. This could potentially aid in reconnaissance or further attacks by revealing file presence and content hashes. The vulnerability requires local access (attack vector: local) and user interaction, with low complexity and no privileges required. The overall impact is rated medium with a CVSS score of 4.6.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when analyzing untrusted ELF binaries with Ghidra versions prior to 12.1. Avoid opening suspicious or unverified ELF files to reduce risk.