CVE-2026-116012
Received Received - Intake

Numeric Truncation in Ghidra PackedDecode Component

Publication date: 2026-10-24

Last updated on: 2026-10-24

Assigner: VulnCheck

Description
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-24
Last Modified
2026-10-24
Generated
2026-10-24
AI Q&A
2026-10-24
EPSS Evaluated
N/A
NVD
CVE-2026-116012
EUVD
EUVD-2026-109270

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
NationalSecurityAgency ghidra 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-197 Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a numeric truncation flaw in Ghidra's decompiler before version 12.2. It occurs in the PackedDecode::skipAttribute and skipAttributeRemaining functions in marshal.cc. Attackers can exploit it by supplying a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.

Detection Guidance

To detect this vulnerability, check the installed version of Ghidra on your system. If you are running a version before 12.2, the system is vulnerable. Use commands like 'ghidra -version' or inspect the installation directory for version details.

Impact Analysis

This vulnerability allows attackers to inject arbitrary structures into the decompiler's input or cause crashes. It requires user interaction but no privileges, potentially leading to denial of service or unexpected behavior during software analysis. The impact is limited to the decompiler process and does not directly affect other system components.

Mitigation Strategies

Upgrade Ghidra to version 12.2 or later immediately. Download the latest release from the official Ghidra GitHub repository and replace the vulnerable version. Verify the update by checking the version again.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116012. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart