EUVD-2026-87373
GHSA-m3q7-8jjf-cmcw
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local because a malicious file must be opened (AV:L), analyst must decompile it (UI:R), no auth needed (PR:N), and memory corruption enables potential full code execution in the user context (C/I/A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled, corrupting memory and potentially achieving code execution.
AnalysisAI
Decompiling a maliciously crafted binary with Ghidra through 12.1.4 can drive a stack-based out-of-bounds write inside the decompiler's leftshift128 routine, letting the sample corrupt process memory and potentially achieve code execution in the analyst's Ghidra session. The flaw is triggered when a specific instruction sequence lowers to p-code containing a negative shift amount that reaches the RuleDivOpt/RuleDivTermAdd divisor-optimization path; no privileges are required (PR:N in both the reported CVSS 4.0 vector and the independent CVSS 3.1 assessment), but exploitation is gated on the victim loading and decompiling the attacker-supplied file (UI:P/UI:R), making this a targeted threat against reverse engineers rather than a remote one. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open an attacker-supplied binary in Ghidra (versions through 12.1.4) and invoke the decompiler on it; the binary must contain a specific instruction sequence that lowers to p-code with a negative shift amount reaching the leftshift128 function via the RuleDivOpt/RuleDivTermAdd decompiler rules. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a real but interaction-gated issue, not a critical remote flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is the upstream Ghidra commit 6babe3c1cec7f5ec920dd16cdc86a02893e5b33c, which hardens the affected shift handling by changing the shift/size parameters from int4 to uint4 in ruleaction.cc/.hh and rejecting shift counts greater than 127 in RuleDivTermAdd2::applyOp; the vendor describes a patch as available, but since the reference is a source commit rather than a tagged release, the specific first patched Ghidra version is not independently confirmed here - upgrade to the earliest Ghidra release that contains this commit and consult https://github.com/NationalSecurityAgency/ghidra and https://www.vulncheck.com/advisories/ghidra-through-12.1.4-stack-based-buffer-overflow-via-leftshift128 for confirmation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Ghidra installation across workstations, analysis VMs, and shared analysis servers (all releases through 12.1.4 are affected) and confirm which of them are used to decompile externally sourced or untrusted binaries; brief reverse-engineering staff immediately that attacker-supplied samples must be opened only inside disposable, network-isolated analysis VMs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files featu
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a pro
NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working directory. Ra
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive)
Command injection in NSA Ghidra (versions before 12.0.3) executes arbitrary commands when analysts click on maliciously
SQL injection in Ghidra's BSim binary-similarity component (versions before 12.1) allows authenticated remote attackers
Authentication bypass in NSA Ghidra versions prior to 12.1 allows any holder of a valid CA-signed certificate to imperso
SQL injection in Ghidra's PostgreSQL collaboration backend (versions 11.0 through pre-12.1) allows authenticated users t
Remote code execution in NSA Ghidra before version 12.1 allows attackers to execute arbitrary commands when a user opens
Command injection in Ghidra versions before 12.1 on Windows allows attackers to execute arbitrary OS commands under the
Arbitrary file write in NSA's Ghidra reverse-engineering framework before version 12.0.4 allows attackers to escape the
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today