CVE-2026-100504 NationalSecurityAgency CVE debrief

Who should care

Defenders responsible for Ghidra installations should assess exposure and prioritize updates. Security teams should review and verify Ghidra versions. Operators of Ghidra installations should be aware of the vulnerability and take necessary actions to prevent potential code execution and memory corruption. Vulnerability management teams should prioritize verifying versions and assessing exposure.

Why it matters

CVE-2026-100504 is a high-severity vulnerability in Ghidra's decompiler. Defenders should prioritize verifying versions, assessing exposure, and updating installations to prevent potential code execution and memory corruption.

• Potential code execution through crafted malicious binaries
• Memory corruption through stack-based out-of-bounds write
• Verification of Ghidra versions and exposure is crucial
• Remediation requires updating Ghidra installations

Technical summary

The vulnerability exists in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences to trigger the overflow. This issue can lead to potential code execution and memory corruption. The vulnerability affects Ghidra versions through 12.1.4. Defenders should prioritize verifying versions and assessing exposure. Security teams should review and verify Ghidra versions and update installations to prevent potential code execution and memory corruption.

Defensive priority

Defenders should prioritize verifying Ghidra versions and assessing exposure. Reviewing and updating Ghidra installations is crucial.

Recommended defensive actions

• Verify Ghidra versions and assess exposure
• Review and update Ghidra installations
• Monitor for potential malicious binaries
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Plan vendor-supported updates or mitigations

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, specific affected versions and remediation steps require further verification from official sources. The vulnerability was disclosed on 2026-09-26T01:17:00.043Z. The CVE Program and NVD provide additional information on the vulnerability. Defenders should verify Ghidra versions and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.