{"id":"CVE-2026-116012","kind":"vulnerability","aliases":["CVE-2026-116012"],"related":[],"title":"Ghidra: crafted packed stream truncates lengths, crashes decompiler or injects attributes","description":"Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.","summary":"Ghidra before 12.2 stores 64-bit string lengths in 32-bit variables inside PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc. A crafted packed stream, such as a malicious .sla file, can inject attributes into the decompiler's input or crash the decompiler process.","severity":"low","cvss":3.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ghidra","package","poc-public","reverse-engineering","security-research"],"not_affected_if":["ghidra-12.2-or-later","only-trusted-files"],"how_to_check":"- Run `ghidra --version` or check the Ghidra install folder for the version number, and see whether it is below `12.2`\n- Check whether the team opens untrusted .sla or packed-format files in Ghidra","fix":"- Upgrade Ghidra to `12.2` or later\n- Only open .sla and packed-format files from trusted sources until upgraded","status":"open","published_at":"2026-10-24T12:16:57+00:00","first_seen_at":"2026-10-24T12:47:58+00:00","triaged_at":"2026-10-25T04:45:22+00:00","updated_at":"2026-10-25T04:45:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:45:22Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Ghidra to `12.2` or later\n- Only open .sla and packed-format files from trusted sources until upgraded","reach":"local","title":"Ghidra: crafted packed stream truncates lengths, crashes decompiler or injects attributes","impact":"low","summary":"Ghidra before 12.2 stores 64-bit string lengths in 32-bit variables inside PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc. A crafted packed stream, such as a malicious .sla file, can inject attributes into the decompiler's input or crash the decompiler process.","category":"package","nicknames":[],"who_cares":["ghidra","reverse-engineering","security-research"],"confidence":0.7,"needs_auth":"no","worst_case":"decompiler process crashes or its input is altered by a crafted file","analyst_note":"","how_to_check":"- Run `ghidra --version` or check the Ghidra install folder for the version number, and see whether it is below `12.2`\n- Check whether the team opens untrusted .sla or packed-format files in Ghidra","needs_analyst":false,"not_affected_if":["ghidra-12.2-or-later","only-trusted-files"],"who_is_affected":"Teams that run Ghidra for reverse engineering or binary analysis and feed it packed-format or .sla files from outside sources, since a crafted file is the attack path. Analysts who only open their own binaries and specifications are much less exposed. Teams on Ghidra 12.2 or later are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000622,"input_tokens":3397,"output_tokens":565,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116012':14A,17A '-2026':13A,16A '12.2':31B,73C '32':38B,93C '64':33B,88C 'attack':96C 'attribut':11A,60B,111C 'bit':34B,39B,89C,94C 'contain':74C 'craft':2A,49B,100C 'crash':7A,67B,118C 'cve':12A,15A 'decompil':8A,63B,69B,114C,120C 'engin':25B 'file':57B,108C 'ghidra':1A,18B,29B,71C 'inject':10A,59B,110C 'input':65B,116C 'insid':41B 'length':6A,36B,91C 'malici':55B,106C 'marshal.cc':47B,85C 'numer':76C 'pack':3A,50B,101C 'packag':19B 'packeddecod':42B,80C 'poc':21B 'poc-publ':20B 'process':70B,121C 'public':22B 'research':28B 'revers':24B 'reverse-engin':23B 'secur':27B 'security-research':26B 'skipattribut':43B,81C 'skipattributeremain':45B,83C 'sla':56B,107C 'store':32B,87C 'stream':4A,51B,102C 'string':35B,90C 'suppli':98C 'truncat':5A,77C 'variabl':40B,95C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Ghidra for reverse engineering or binary analysis and feed it packed-format or .sla files from outside sources, since a crafted file is the attack path. Analysts who only open their own binaries and specifications are much less exposed. Teams on Ghidra 12.2 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T12:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-116012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116012","severity":null,"published_at":"2026-10-24T12:16:57+00:00","modified_at":"2026-10-24T12:16:57+00:00","first_seen_at":"2026-10-24T12:47:58+00:00","fetched_at":"2026-10-24T12:47:58+00:00","note":null},{"source":"github-poc","external_id":"D7EAD/CVE-2026-116012","url":"https://github.com/D7EAD/CVE-2026-116012","severity":null,"published_at":"2026-10-24T19:13:32+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:23:49+00:00","fetched_at":"2026-10-24T19:23:49+00:00","note":null}],"documents":[{"id":2938,"url":"https://github.com/D7EAD/CVE-2026-116012","title":"D7EAD/CVE-2026-116012","kind":"poc","source":"github","text":"NSA Ghidra contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc.\n\nstars 0","published_at":"2026-10-24T19:13:32+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}