CVE-2026-100503

EUVD-2026-87372
Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.3 LOW
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 1.72%
Affected Products (NVD)
VendorProductVersion
nsaghidra
𝑥
≤ 12.1.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/NationalSecurityAgency/ghidra
https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/merge.cc#L462-L472
https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/subflow.cc#L2717-L2745
https://github.com/NationalSecurityAgency/ghidra/commit/5ef1ee4d7a25a65db195f3a70f681ca74440be61
https://www.vulncheck.com/advisories/ghidra-through-12.1.4-heap-use-after-free-in-decompiler