Vulnerability Description
Ghidra before 12.1 contains a path traversal vulnerability in SameDirDebugInfoProvider that fails to validate filenames from ELF binary .gnu_debuglink sections before constructing file paths. Attackers can craft malicious ELF binaries with traversal sequences to probe filesystem existence and leak CRC32 hashes of arbitrary files during automatic DWARF analysis.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nsa | Ghidra | < 12.1 |
Related Weaknesses (CWE)
References
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-57g6-7ExploitVendor Advisory
- https://www.vulncheck.com/advisories/ghidra-path-traversal-via-gnu-debuglink-in-Third Party Advisory
FAQ
What is CVE-2026-49497?
CVE-2026-49497 is a vulnerability with a CVSS score of 3.3 (LOW). Ghidra before 12.1 contains a path traversal vulnerability in SameDirDebugInfoProvider that fails to validate filenames from ELF binary .gnu_debuglink sections before constructing file paths. Attacker...
How severe is CVE-2026-49497?
CVE-2026-49497 has been rated LOW with a CVSS base score of 3.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-49497?
Check the references section above for vendor advisories and patch information. Affected products include: Nsa Ghidra.