CVE-2026-100503

Low

Description

Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines.

SeverityLow

CVSS3.3

Exploit probability—

ProductNsa Ghidra

PublishedSep 26, 2026

First seenSep 26, 2026

Weakness typeCWE-416Use after free

How to fix

Patches

github.com/NationalSecurityAgency/ghidra/commit/5ef1ee4d7a25a65db195f3a70f681ca74440be61

Affected products

Product	Affected versions	Fixed in
nsa ghidra	v ≤ 12.1.4	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.