Ghidra EUVD-2026-109270

Exploitation requires an analyst to open or import a crafted packed stream - such as a malicious .sla file or other decompiler input that reaches PackedDecode::skipAttribute/skipAttributeRemaining during openElement attribute scanning - into Ghidra; this is reflected by AV:L (local file processing) and UI:P (the victim must load the file). Default Ghidra configurations parse such input, so no special feature toggle is needed, but the attacker must deliver the file and rely on the analyst processing attacker-supplied material, which is the core limiting factor. Impact is bounded to the decompiler process (parser confusion, attribute injection, or crash) with no confidentiality impact (VC:N) and only limited integrity/availability effects; the AT:P requirement reflects that a specific crafted length value (0x100000000-style) is needed to trigger the truncation, and the exact triggering conditions beyond this are as described in the GHSA source analysis.

This is a genuinely low-priority issue, and the signals agree. The CVSS 4.0 base score is 2.0 (Low) with vector AV:L/AC:L/AT:P/PR:N/UI:P and only limited integrity/availability impact (VI:L/VA:L, VC:N) - confirming a local, user-interaction-dependent flaw with no confidentiality exposure and no remote reach. The vuln.today Decision label is 'monitor', the weakest urgency tier, consistent with the low score. There is no CISA KEV listing and no EPSS score was provided; exploitation status is no public exploit identified at time of analysis - the VulnCheck and GHSA references are vendor/finder advisories and a patch commit, not working exploit code. The one cross-signal nuance: the GHSA advisory stresses that this parser-state corruption 'can chain with the handle_index and operand index OOB vulnerabilities in the same codebase,' so the real risk is higher as a chaining primitive than as a standalone bug, though those other flaws are outside this record and unverified here. Net: a real but low-severity defect whose worst realistic outcome is a crashed or confused decompiler process on a reverse engineer's workstation, not a widespread exploitation threat.

An attacker crafts a malicious packed stream (such as a booby-trapped .sla SLEIGH file or other decompiler input) and gets a reverse engineer or malware analyst to load it into Ghidra. When the decompiler's PackedDecode parser skips a string attribute whose length is 0x100000000, the 64-bit length truncates to 0, leaving the parser cursor inside attacker-controlled data that is then re-interpreted as legitimate packed protocol elements, injecting arbitrary attributes or crashing the decompiler process. No public working exploit code is identified at this time.