Threats Tagged 'ghsa-4xhp-h6c8-q4h9'

Ghidra versions 9.2 through 12.1.4 have a heap out-of-bounds read vulnerability in the StringManager::getCodepoint function when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters. This occurs because the function does not validate the remaining buffer length, allowing crafted binaries with specially formed strings to trigger out-of-bounds reads. Exploitation can cause crashes or leak adjacent heap memory into the decompiled output.