CVE-2026-116012 in Ghidra
Summary
by MITRE • 10/24/2026
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability identified in Ghidra prior to version 12.2 represents a critical integer handling flaw within its binary analysis and reverse engineering components. Specifically, the issue resides in the PackedDecode module, which is responsible for parsing packed data streams used by various Ghidra features including decompilation and script loading. The core technical defect involves a numeric truncation error where 64-bit string length values are incorrectly stored into 32-bit integer variables during the execution of the skipAttribute and skipAttributeRemaining functions in marshal.cc. This type of vulnerability is classically categorized under CWE-197, which defines Numeric Truncation Errors, occurring when data with a larger range or precision than expected is assigned to a variable that cannot accommodate it without loss of information.
When an attacker supplies a crafted packed stream, such as a malicious .sla file (Ghidra Script Archive), the application processes the input through these vulnerable functions. Because the 64-bit length value exceeds the maximum capacity of a signed or unsigned 32-bit integer depending on implementation details, the upper bits are discarded during storage. This truncation results in a significantly smaller numeric value being used for subsequent memory allocation and buffer operations than what was originally specified by the attacker. Consequently, the application may allocate insufficient heap space based on the truncated length while attempting to read or process data indicated by the original full 64-bit size.
The operational impact of this flaw is severe due to its potential for both denial of service and arbitrary code execution. If the truncation leads to a buffer overflow where more data is written than allocated, it can corrupt adjacent memory structures, potentially allowing an attacker to inject malicious attributes into the decompiler's input stream or overwrite critical control flow data such as return addresses on the stack. This aligns with CWE-120, Buffer Copy without Checking Size of Input, and CWE-787, Out-of-bounds Write. In scenarios where memory corruption does not lead directly to code execution, the instability caused by invalid pointer dereferences or heap metadata corruption will result in a crash of the decompiler process, constituting a denial of service condition that disrupts reverse engineering workflows.
From an adversary perspective, this vulnerability facilitates techniques associated with ATT&CK T1059, Command and Scripting Interpreter, if the injected attributes allow for unintended script execution or manipulation of analysis results. It also relates to ATT&CK T1203, Exploitation for Client Execution, as malicious .sla files are often distributed via phishing campaigns targeting security researchers and analysts who use Ghidra daily. The exploitation requires user interaction to open the crafted file, but given that reverse engineers frequently handle binaries from untrusted sources or analyze malware samples, the risk surface is substantial.
Mitigation strategies primarily involve upgrading to Ghidra version 12.2 or later where this integer truncation issue has been resolved by implementing proper type casting and bounds checking before memory allocation. For environments unable to upgrade immediately, defensive measures include restricting the execution of scripts from untrusted sources through strict code signing policies within Ghidra's configuration settings. Additionally, deploying sandboxed analysis environments can limit the impact if a crafted file is inadvertently opened, preventing potential host compromise resulting from heap exploitation techniques derived from this vulnerability.