EUVD-2026-87374
GHSA-4xhp-h6c8-q4h9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local because an analyst must load the crafted file (AV:L, UI:R); no auth needed (PR:N); over-read yields limited heap disclosure (C:L) and decompiler crash (A:L), no integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Ghidra versions 11.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries with constant byte stores ending in multi-byte lead units to trigger out-of-bounds reads that crash the decompiler or leak adjacent heap memory into decompiled output.
AnalysisAI
Heap out-of-bounds reads in Ghidra 11.2 through 12.1.4 allow an attacker who supplies a crafted binary to make the decompiler read past the end of a string buffer while decoding multi-byte UTF-8, UTF-16, or UTF-32 characters, resulting in a decompiler crash or the leakage of adjacent heap bytes into the decompiled output. The issue is local rather than network-facing: it requires the victim to load and decompile the malicious file (CVSS v4.0 AV:L/PR:N/UI:P, base 4.8 MEDIUM; independent assessment CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L), and the impact is capped at low confidentiality and low availability with no integrity or code-execution effect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open and decompile an attacker-crafted binary in a vulnerable Ghidra 11.2-12.1.4 install; the malicious file must contain constant byte stores ending in a multi-byte UTF-8/UTF-16/UTF-32 lead unit at the tail of a buffer so getCodepoint reads beyond the remaining buffer length. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 4.8 (MEDIUM) is consistent with the real-world risk: this is a heap out-of-bounds READ (CWE-125), not a write, so the ceiling is a decompiler crash (VA:L) or leakage of adjacent heap bytes into decompiled output (VC:L) - no code execution or integrity impact (VI:N/SI:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix: commit e37c57f3d9c29511a1860f0a735df53131d403d7 (https://github.com/NationalSecurityAgency/ghidra/commit/e37c57f3d9c29511a1860f0a735df53131d403d7) adds the remaining-buffer-length parameter and bounds checks to StringManager::getCodepoint() and updates all three call sites; patch status is "Upstream fix available (PR/commit); released patched version not independently confirmed," so confirm through the vendor advisory (https://www.vulncheck.com/advisories/ghidra-11.2-through-12.1.4-heap-out-of-bounds-read-via-stringmanager) which tagged Ghidra release contains this commit before upgrading, and prefer any build newer than 12.1.4 that includes it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files featu
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a pro
NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working directory. Ra
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive)
Command injection in NSA Ghidra (versions before 12.0.3) executes arbitrary commands when analysts click on maliciously
SQL injection in Ghidra's BSim binary-similarity component (versions before 12.1) allows authenticated remote attackers
Authentication bypass in NSA Ghidra versions prior to 12.1 allows any holder of a valid CA-signed certificate to imperso
SQL injection in Ghidra's PostgreSQL collaboration backend (versions 11.0 through pre-12.1) allows authenticated users t
Remote code execution in NSA Ghidra before version 12.1 allows attackers to execute arbitrary commands when a user opens
Command injection in Ghidra versions before 12.1 on Windows allows attackers to execute arbitrary OS commands under the
Arbitrary file write in NSA's Ghidra reverse-engineering framework before version 12.0.4 allows attackers to escape the
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today