CVE-2026-100505 NationalSecurityAgency CVE debrief

Who should care

Defenders responsible for Ghidra installations, developers using Ghidra for decompilation, and security teams monitoring for potential vulnerabilities in their inventory should be aware of this vulnerability and take steps to verify and patch their Ghidra versions.

Why it matters

Defenders should prioritize verifying Ghidra versions and applying patches to prevent potential crashes or information leaks. This vulnerability requires verification of Ghidra versions and inventory checks to determine exposure.

• Potential crashes or anomalies in decompiler output
• Information leaks through adjacent heap memory disclosure

Technical summary

The vulnerability exists in the StringManager::getCodepoint function when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating the remaining buffer length. Attackers can craft malicious binaries to trigger out-of-bounds reads, causing the decompiler to crash or leak adjacent heap memory into decompiled output. This vulnerability affects Ghidra versions 11.2 through 12.1.4 and requires verification of Ghidra versions and inventory checks to determine exposure. Defenders should prioritize verifying Ghidra versions and applying patches to prevent potential crashes or information leaks.

Defensive priority

Defenders should prioritize verifying Ghidra versions and applying patches to prevent potential crashes or information leaks.

Recommended defensive actions

• Verify Ghidra version and apply patches
• Review and update inventory of Ghidra installations
• Monitor for potential crashes or anomalies in decompiler output
• Perform compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Review vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Additional information on affected versions and remediation is needed. Ghidra users should verify their versions and check for patches. The vulnerability affects Ghidra versions 11.2 through 12.1.4, and attackers can craft malicious binaries to trigger out-of-bounds reads. Evidence from the CVE record and NVD entry suggests that defenders should prioritize verifying Ghidra versions and applying patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.