Vulnerability Description
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra
- https://github.com/NationalSecurityAgency/ghidra/commit/d105789b331dba84ad73ab92
- https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v423-5
- https://www.vulncheck.com/advisories/ghidra-before-12.2-integer-truncation-in-pa
FAQ
What is CVE-2026-116012?
CVE-2026-116012 is a vulnerability with a CVSS score of 3.6 (LOW). Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers ...
How severe is CVE-2026-116012?
CVE-2026-116012 has been rated LOW with a CVSS base score of 3.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116012?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.