Is there a patch available for CVE-2026-49497?

Yes, a patch is available for CVE-2026-49497. Update the affected software to the latest version immediately.

Ghidra CVE-2026-49497

Q: What is the CVSS score of CVE-2026-49497?

CVE-2026-49497 has a CVSS 4.0 base score of 4.6 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36006 MEDIUM

Path Traversal (CWE-22)

2026-06-10 VulnCheck

Path Traversal Ghidra

4.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

4.6 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 10, 2026 - 15:01 EUVD

Analysis Generated

Jun 10, 2026 - 14:27 vuln.today

Severity Changed

Jun 10, 2026 - 14:22 NVD

LOW MEDIUM

CVSS changed

Jun 10, 2026 - 14:22 NVD

3.3 (LOW) 4.6 (MEDIUM)

DescriptionCVE.org

Ghidra before 12.1 contains a path traversal vulnerability in SameDirDebugInfoProvider that fails to validate filenames from ELF binary .gnu_debuglink sections before constructing file paths. Attackers can craft malicious ELF binaries with traversal sequences to probe filesystem existence and leak CRC32 hashes of arbitrary files during automatic DWARF analysis.

AnalysisAI

Path traversal in Ghidra's SameDirDebugInfoProvider (versions before 12.1) enables filesystem probing and CRC32 hash leakage of arbitrary files when a user opens a crafted ELF binary during automatic DWARF analysis. The vulnerability stems from missing validation of filenames embedded in ELF .gnu_debuglink sections before those filenames are used to construct filesystem paths. No public exploit code is currently identified and it is not listed in CISA KEV, but the risk is notable for security researchers and reverse engineers who routinely analyze untrusted binaries.

Technical ContextAI

Ghidra is the NSA's open-source software reverse engineering framework. The vulnerable component, SameDirDebugInfoProvider, implements automatic external debug-file resolution: when Ghidra's DWARF analysis engine processes an ELF binary, it reads the .gnu_debuglink section to locate a companion debug file. The .gnu_debuglink section contains an attacker-controlled filename and a CRC32 checksum. Ghidra constructs a filesystem path from this filename without sanitizing path traversal sequences (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). As a consequence, sequences such as '../../../etc/shadow' in the section cause Ghidra to probe those paths on the analyst's machine. The CRC32 of the target file is then compared or exposed during the resolution process, leaking filesystem content metadata. Affected product confirmed by CPE cpe:2.3:a:nationalsecurityagency:ghidra:*:*:*:*:*:*:*:* covering all versions before 12.1.

RemediationAI

Upgrade to Ghidra 12.1 or later, which contains the vendor-released patch for this vulnerability per the advisory GHSA-57g6-7qw2-p5hx at https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-57g6-7qw2-p5hx. As a compensating control for environments that cannot immediately upgrade, users should disable automatic DWARF debug-file resolution in Ghidra's analysis options - this eliminates the vulnerable code path but will prevent automatic loading of external debug symbols, requiring manual symbol resolution workflows. Additionally, analysts should avoid opening ELF binaries from untrusted sources in unpatched Ghidra versions, or analyze such files in an isolated environment (e.g., air-gapped VM) where filesystem probing cannot expose sensitive host files.