CVE-2026-116012Low· 3.6▾ TwilightPoC availableGhidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, s…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 19.8 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Oct 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
1 GitHub repo
0.2%
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.
ghidra < 12.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115398Medium· 5.5Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount
CVE-2026-115395Medium· 5.5Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()
CVE-2026-115503Medium· 5.5Ghidra before 12.2 Denial of Service via Compressed Extension Archive
CVE-2026-115396Medium· 5.5Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive
CVE-2026-115397Medium· 5.5Ghidra before 12.2 Denial of Service via Extension Archive Install
CVE-2026-18718High· 7.0Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path