EUVD-2026-36016Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Ghidra before 12.1 contains a heap-use-after-free vulnerability in the decompiler's HighVariable::merge() function during the variable merging pass. Attackers can trigger this vulnerability by crafting a binary that causes stale pointers in the HighIntersectTest::highedgemap cache to be dereferenced, reading and writing the flags field of freed heap memory when a user opens the binary in Ghidra's decompiler view.
AnalysisAI
Heap-use-after-free corruption in Ghidra's decompiler before version 12.1 allows a local attacker - or any actor who can deliver a crafted binary to a target analyst - to corrupt freed heap memory when the victim opens the file in the decompiler view. The vulnerability resides in HighVariable::merge() during the variable merging pass, where stale pointers in the HighIntersectTest::highedgemap cache are dereferenced against freed memory, producing low-impact integrity and availability effects on the Ghidra process. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the tool's user base of security researchers who routinely open untrusted binaries elevates the practical threat profile.
Technical ContextAI
Ghidra is NSA's open-source reverse engineering framework (CPE: cpe:2.3:a:nationalsecurityagency:ghidra:*:*:*:*:*:*:*:*), and this vulnerability lives inside its decompiler engine. CWE-416 (Use After Free) describes the root cause class: during the variable merging pass, the HighVariable::merge() function fails to properly invalidate or refresh cached pointers in the HighIntersectTest::highedgemap data structure after the backing heap objects are freed. When the decompiler later processes these stale cache entries, it dereferences pointers to already-freed memory regions and reads and writes the flags field of those objects. This is a classic temporal memory safety violation - the object lifetime ends, but a reference to it persists in a cache that is not cleared, creating a window where freed memory can be accessed with attacker-influenced data from a crafted binary's structure.
RemediationAI
Upgrade to Ghidra 12.1 or later, which resolves the heap-use-after-free in HighVariable::merge() per the vendor advisory at https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-8jqp-qv73-395r. Prior to patching, the most effective compensating control is to restrict decompiler usage to sandboxed or isolated environments - for example, running Ghidra inside a disposable container or VM when analyzing untrusted samples, a practice already aligned with safe malware analysis hygiene. This eliminates the ability of a triggered crash or memory corruption event to affect the analyst's host system, at the cost of minor workflow overhead when spinning up isolated instances. Analysts should avoid opening binaries from untrusted sources directly on production workstations using unpatched Ghidra versions. There is no known configuration flag to disable the variable merging pass without degrading decompiler functionality, so sandboxing is the most practical pre-patch mitigation.
Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files featu
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a pro
NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working directory. Ra
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive)
Command injection in NSA Ghidra (versions before 12.0.3) executes arbitrary commands when analysts click on maliciously
SQL injection in Ghidra's BSim binary-similarity component (versions before 12.1) allows authenticated remote attackers
Authentication bypass in NSA Ghidra versions prior to 12.1 allows any holder of a valid CA-signed certificate to imperso
SQL injection in Ghidra's PostgreSQL collaboration backend (versions 11.0 through pre-12.1) allows authenticated users t
Remote code execution in NSA Ghidra before version 12.1 allows attackers to execute arbitrary commands when a user opens
Command injection in Ghidra versions before 12.1 on Windows allows attackers to execute arbitrary OS commands under the
Arbitrary file write in NSA's Ghidra reverse-engineering framework before version 12.0.4 allows attackers to escape the
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today