Description
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NationalSecurityAgency | ghidra | < 12.2 | 12.2 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
D7EAD/CVE-2026-116012 ★ 3 · Oct 24, 2026
NSA Ghidra contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- GitHub Security Advisory (GHSA-v423-5vh7-c7jw) vendor-advisory
- https://github.com/NationalSecurityAgency/ghidra/commit/d105789b331dba84ad73ab92db890e38fe665be0 patch
- ghidra Ghidra_12.2_build Release Notes release-notes
- https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Decompiler/src/decompile/cpp/marshal.cc#L641-L671 technical-description
- VulnCheck Advisory: Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser third-party-advisory