PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45181 Blog CVE debrief

CVE-2026-45181 is a medium-severity issue in Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2. The problem is that IDA does not block Clang dependency-file generation through argument injection. If a victim opens an attacker-supplied .i64 file, the issue can cause attacker code to be written into a plugins directory. Hex-Rays lists the fix in 9.3sp2.

Vendor
Blog
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-09
Original CVE updated
2026-07-24
Advisory published
2026-05-09
Advisory updated
2026-07-24

Who should care

IDA Pro users and administrators, especially anyone who opens or analyzes .i64 files from untrusted or third-party sources. Security teams that rely on IDA in shared workstations, reverse-engineering labs, or malware-analysis environments should also treat this as relevant.

Technical summary

NVD describes the weakness as CWE-88 (argument injection). The supplied CVE record says IDA Pro before 9.3sp2 does not block Clang dependency-file generation via injected arguments. In the reported scenario, an attacker-supplied .i64 file can influence that behavior enough to place attacker-controlled code into a plugins directory. The issue is tied to local interaction (UI:R) and has CVSS 3.1 vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L.

Defensive priority

Prioritize patching if your environment opens untrusted .i64 files or uses IDA on shared systems. The score is medium (6.5), but the workflow impact can be meaningful because the flaw is triggered through analysis of attacker-supplied project files.

Recommended defensive actions

  • Upgrade Hex-Rays IDA Pro to 9.3sp2 or later.
  • Treat .i64 files from untrusted sources as high risk and isolate their analysis.
  • Restrict where IDA can read and write files during analysis to reduce the impact of file-placement behavior.
  • Review plugin directories and related startup paths for unexpected or newly added files after analyzing suspicious projects.
  • Update internal guidance for reverse-engineering or malware-analysis workflows to include this CVE.

Evidence notes

Based only on the supplied CVE record and official references. The CVE description states the affected products, the pre-9.3sp2 condition, the Clang dependency-file generation/argument-injection issue, and the .i64-triggered plugin-directory write outcome. NVD lists CWE-88 and the CVSS 3.1 vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L. Published 2026-05-09 and modified 2026-05-10; no KEV entry was supplied.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45181 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45181

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45181 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45181

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.