Executive Summary

CVE-2026-49497 is a path traversal vulnerability in Ghidra versions before 12.1, specifically in the SameDirDebugInfoProvider component. This vulnerability occurs because Ghidra does not properly validate filenames extracted from the .gnu_debuglink section of ELF binaries.

Attackers can craft malicious ELF binaries containing path traversal sequences (like ../../../../../../../etc/shadow) that cause Ghidra to probe the local filesystem for the existence of arbitrary files. During automatic DWARF analysis, Ghidra reads these filenames without sanitization, constructs file paths, and if the targeted files exist, it reads them and leaks their CRC32 hashes.

This leakage of CRC32 hashes can expose sensitive filesystem information to an attacker, especially in automated analysis pipelines where log outputs might be captured and returned to the binary submitter.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to probe your filesystem for the existence of arbitrary files and leak CRC32 hashes of their contents. This can reveal sensitive information about your system's files without requiring privileges.

If you use Ghidra to analyze ELF binaries, opening a maliciously crafted binary could cause Ghidra to automatically perform these probes and leak information through logs or analysis outputs.

In automated analysis environments, this information leakage could be captured and sent back to the attacker, potentially exposing details about your filesystem structure and file contents.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is triggered when Ghidra imports ELF binaries containing malicious .gnu_debuglink sections with path traversal sequences. Detection involves monitoring Ghidra's DWARF analysis logs for unexpected file path accesses or CRC32 hash computations of files outside the expected directories.

Since the vulnerability occurs during ELF import in Ghidra, you can detect exploitation attempts by checking for suspicious log entries or file access patterns indicating path traversal sequences like "../../" in filenames processed by SameDirDebugInfoProvider.

There are no specific commands provided in the resources, but general detection steps include:

• Review Ghidra logs for file paths containing traversal sequences or unexpected file hashes.
• Monitor ELF binaries imported into Ghidra for suspicious .gnu_debuglink section filenames with path traversal patterns.
• Use file integrity monitoring tools to detect unexpected file reads or hash computations triggered by Ghidra.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Ghidra to version 12.1 or later, where the vulnerability is fixed by applying filename validation (ensureSafeFilename()) in the SameDirDebugInfoProvider component.

Until the upgrade is possible, avoid importing untrusted or suspicious ELF binaries with potentially malicious .gnu_debuglink sections into Ghidra.

Additionally, consider disabling automatic DWARF analysis or external debug file resolution features in Ghidra if feasible, to reduce exposure.

Useful 0 Not Useful 0