CVE-2026-100503— Ghidra through 12.1.4 Heap Use-After-Free in Decompiler
Quick assessment
Affected
NationalSecurityAgency ghidra
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Ghidra 12.1.4 及更早版本存在堆上释放后使用（heap use-after-free）漏洞，该漏洞位于反编译器的 函数中，由过时的 INDIRECT 效果操作引用引发。攻击者可构造包含特定 x86-64 指令序列的恶意二进制文件，在反编译过程中触发此漏洞，导致反编译辅助进程崩溃，从而对分析师和自动化分析流水线造成拒绝服务攻击。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100503
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ghidra through 12.1.4 Heap Use-After-Free in Decompiler
Source: CVE Program / CVE List V5
Vulnerability Description
Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| NationalSecurityAgency | ghidra | 0 ~ 12.1.4 | - |
|
II. Public POCs for CVE-2026-100503
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100503
请登录查看更多情报信息。
News Coverage for CVE-2026-100503 (1)
-
🔗 Ghidra through 12.1.4 Heap Use-After-Free in Decompiler | Advisories | VulnCheck third-party-advisory
Vendor Pages for CVE-2026-100503 (1)
Other References for CVE-2026-100503 (3)
Same Patch Batch · NationalSecurityAgency · 2026-09-26 · 3 CVEs total
| CVE-2026-100504 | 7.0 HIGH | Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128 |
| CVE-2026-100505 | 4.4 MEDIUM | Ghidra 11.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager |
IV. Related Vulnerabilities
Same product: ghidra
-
CVE-2026-100504
Ghidra through 12.1.4 Stack-based Buffer Overflow via leftsh -
CVE-2026-100505
Ghidra 11.2 through 12.1.4 Heap Out-of-Bounds Read via Strin -
CVE-2026-96273
Ghidra before 12.1.4 Denial of Service via Crafted Database -
CVE-2026-54389
Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via -
CVE-2026-18718
Ghidra Swift Demangler Analyzer Arbitrary Code Execution via
Same vendor: NationalSecurityAgency
-
CVE-2026-100504
Ghidra through 12.1.4 Stack-based Buffer Overflow via leftsh -
CVE-2026-100505
Ghidra 11.2 through 12.1.4 Heap Out-of-Bounds Read via Strin -
CVE-2026-96273
Ghidra before 12.1.4 Denial of Service via Crafted Database -
CVE-2026-54694
NationalSecurityAgency/skills-service has Stored XSS via Use -
CVE-2026-54389
Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via
Same weakness: CWE-416
-
CVE-2026-15442
Heap use-after-free on read during bidirectional (D)TLS shut -
CVE-2026-95834
Use after free in the kitty drag and drop protocol when a dr -
CVE-2026-97222
Gnumeric: gnumeric: heap use-after-free when opening a malfo -
CVE-2026-93834
Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows -
CVE-2026-6928
Multiple Vulnerabilities in IBM Concert Software
V. Comments for CVE-2026-100503
No comments yet