EUVD-2026-87372
GHSA-7rr6-c8rx-m78p
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local because a crafted file must be fed to the decompiler (AV:L); requires the analyst/pipeline to decompile it (UI:R); no auth needed (PR:N); impact is only a helper-process crash (A:L, C:N/I:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines.
AnalysisAI
Decompiling an attacker-crafted x86-64 binary in NSA Ghidra through version 12.1.4 can crash the decompiler helper process via a heap use-after-free in Funcdata::opInsertAfter, denying service to analysts and automated analysis pipelines. The vulnerability is triggered only when a victim actively loads and decompiles a malicious sample containing a specific instruction sequence that leaves stale INDIRECT effect-op references in the decompiler's internal P-code model; it is a local, user-interaction-required issue (CVSS 4.0 4.8; assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:R, C:N/I:N/A:L) with no confidentiality or integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a victim load and decompile an attacker-crafted x86-64 binary in Ghidra (versions through 12.1.4); the malicious sample must contain a specific instruction sequence that leaves stale INDIRECT effect-op references processed by the decompiler's INDIRECT-collapse logic. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-severity, availability-only issue despite being a memory-corruption class bug (CWE-416 use-after-free). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (commit 5ef1ee4d7a25a65db195f3a70f681ca74440be61); a released patched version number is not independently confirmed by the provided data, so treat any Ghidra build containing this commit (i.e. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files featu
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a pro
NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working directory. Ra
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive)
Command injection in NSA Ghidra (versions before 12.0.3) executes arbitrary commands when analysts click on maliciously
SQL injection in Ghidra's BSim binary-similarity component (versions before 12.1) allows authenticated remote attackers
Authentication bypass in NSA Ghidra versions prior to 12.1 allows any holder of a valid CA-signed certificate to imperso
SQL injection in Ghidra's PostgreSQL collaboration backend (versions 11.0 through pre-12.1) allows authenticated users t
Remote code execution in NSA Ghidra before version 12.1 allows attackers to execute arbitrary commands when a user opens
Command injection in Ghidra versions before 12.1 on Windows allows attackers to execute arbitrary OS commands under the
Arbitrary file write in NSA's Ghidra reverse-engineering framework before version 12.0.4 allows attackers to escape the
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today