Live › vulnerability › CVE-2026-116012
Go to dashboardGhidra before 12.2 stores 64-bit string lengths in 32-bit variables inside PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc. A crafted packed stream, such as a malicious .sla file, can inject attributes into the decompiler's input or crash the decompiler process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 12:47 UTC. All times on this page are UTC.
Teams that run Ghidra for reverse engineering or binary analysis and feed it packed-format or .sla files from outside sources, since a crafted file is the attack path. Analysts who only open their own binaries and specifications are much less exposed. Teams on Ghidra 12.2 or later are not affected.
No product ranges from the sources yet.
ghidra --version or check the Ghidra install folder for the version number, and see whether it is below 12.212.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.
This page as .md · .json · in your agent: get_signal("CVE-2026-116012")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.