CVE-2026-100505— Ghidra 11.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager
Quick assessment
Affected
NationalSecurityAgency ghidra
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Ghidra 版本 11.2 至 12.1.4 存在一个堆缓冲区越界读取漏洞。该漏洞位于 函数中，其在解码多字节 UTF-8、UTF-16 或 UTF-32 字符时，未对剩余缓冲区长度进行有效验证。攻击者可以构造包含以多字节前导单元结尾的常量字节存储的恶意二进制文件，从而触发越界读取，导致反编译器崩溃或将相邻堆内存内容泄露至反编译输出中。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100505
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ghidra 11.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager
Source: CVE Program / CVE List V5
Vulnerability Description
Ghidra versions 11.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries with constant byte stores ending in multi-byte lead units to trigger out-of-bounds reads that crash the decompiler or leak adjacent heap memory into decompiled output.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| NationalSecurityAgency | ghidra | 11.2 ~ 12.1.4 | - |
|
II. Public POCs for CVE-2026-100505
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100505
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-100505 (1)
Vendor Pages for CVE-2026-100505 (1)
Other References for CVE-2026-100505 (2)
Same Patch Batch · NationalSecurityAgency · 2026-09-26 · 3 CVEs total
| CVE-2026-100504 | 7.0 HIGH | Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128 |
| CVE-2026-100503 | 3.3 LOW | Ghidra through 12.1.4 Heap Use-After-Free in Decompiler |
IV. Related Vulnerabilities
Same product: ghidra
-
CVE-2026-100504
Ghidra through 12.1.4 Stack-based Buffer Overflow via leftsh -
CVE-2026-100503
Ghidra through 12.1.4 Heap Use-After-Free in Decompiler -
CVE-2026-96273
Ghidra before 12.1.4 Denial of Service via Crafted Database -
CVE-2026-54389
Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via -
CVE-2026-18718
Ghidra Swift Demangler Analyzer Arbitrary Code Execution via
Same vendor: NationalSecurityAgency
-
CVE-2026-100504
Ghidra through 12.1.4 Stack-based Buffer Overflow via leftsh -
CVE-2026-100503
Ghidra through 12.1.4 Heap Use-After-Free in Decompiler -
CVE-2026-96273
Ghidra before 12.1.4 Denial of Service via Crafted Database -
CVE-2026-54694
NationalSecurityAgency/skills-service has Stored XSS via Use -
CVE-2026-54389
Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via
Same weakness: CWE-125
-
CVE-2026-94285
Out-of-bounds read in libX11's byte-oriented codeset parser -
CVE-2026-94284
Out-of-bounds read vulnerability in libX11's XIM trigger-key -
CVE-2026-94283
Out-of-bounds read vulnerability in libX11's XIM (X Input Me -
CVE-2026-94282
Out-of-bounds read in libXi's XI2 enter/leave/focus cookie c -
CVE-2026-100387
pgPointcloud through 1.2.5 heap out-of-bounds read via WKB d
V. Comments for CVE-2026-100505
No comments yet