CVE-2026-100505 in Ghidra
Summary
by MITRE • 09/26/2026
Ghidra versions 11.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries with constant byte stores ending in multi-byte lead units to trigger out-of-bounds reads that crash the decompiler or leak adjacent heap memory into decompiled output.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Ghidra versions 11.2 through 12.1.4 represents a critical security flaw within the StringManager::getCodepoint function, which is responsible for decoding multi-byte character encodings such as UTF-8, UTF-16, and UTF-32 during the binary analysis process. This heap out-of-bounds read vulnerability arises from a failure to validate the remaining buffer length before attempting to decode characters that span multiple bytes. When Ghidra processes maliciously crafted binaries containing constant byte stores that end with multi-byte lead units, the decoder attempts to access memory locations beyond the allocated buffer boundary to complete the character sequence. This lack of bounds checking allows an attacker who can supply a custom binary or plugin input to trigger unintended memory reads, leading to either application crashes through segmentation faults or the leakage of adjacent heap memory contents into the decompiled output.
From a technical perspective, this flaw is classified under CWE-125, which denotes Out-of-bounds Read vulnerabilities. The root cause lies in the absence of rigorous boundary checks within the string decoding logic, specifically when handling variable-length encodings where the decoder must look ahead to determine character boundaries. In standard UTF-8 encoding, for instance, a lead byte indicates that subsequent bytes are part of the same character; if the buffer ends prematurely after such a lead byte without proper validation, the function proceeds to read invalid memory addresses. This behavior is particularly dangerous in reverse engineering tools like Ghidra because they process untrusted binary inputs from various sources, including potentially malicious software samples submitted for analysis. The vulnerability aligns with ATT&CK technique T1059, Command and Scripting Interpreter, as it involves the execution of code that manipulates system resources through malformed input data, although its primary impact is on availability and confidentiality rather than direct command execution.
The operational impact of this vulnerability is twofold, affecting both the stability and the security posture of users employing Ghidra for reverse engineering tasks. First, the out-of-bounds read can cause the decompiler to crash unexpectedly, resulting in a denial of service that disrupts ongoing analysis sessions and potentially leads to data loss if unsaved work exists. Second, and more critically, the ability to leak adjacent heap memory into the decompiled output poses significant confidentiality risks. Sensitive information such as cryptographic keys, authentication tokens, or other private data residing in nearby memory allocations may be exposed within the disassembly view, allowing an attacker to extract valuable intelligence from a victim's analysis environment. This leakage could also facilitate further exploitation by providing context about the application’s internal state or memory layout, aiding in subsequent attacks against the host system.
To mitigate this vulnerability, users of Ghidra versions 11.2 through 12.1.4 should immediately upgrade to version 12.1.5 or later, where the StringManager::getCodepoint function has been patched with proper bounds checking logic. Developers integrating Ghidra into automated pipelines must ensure that their environments are updated to prevent exposure to crafted binaries designed to exploit this flaw. Additionally, security teams should implement input validation mechanisms when processing binary files from untrusted sources, treating all external inputs as potentially malicious until proven otherwise. Regular updates and patch management remain the most effective defense against such memory corruption vulnerabilities, ensuring that known flaws in widely used reverse engineering tools do not compromise analyst workflows or sensitive data integrity.