CVE-2026-100503
Received Received - Intake

Heap Use-After-Free in Ghidra Decompiler

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100503
EUVD
EUVD-2026-87372

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
national_security_agency ghidra to 12.1.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap use-after-free flaw in Ghidra versions through 12.1.4. It occurs in the decompiler's Funcdata::opInsertAfter function due to stale INDIRECT effect-op references. Attackers can exploit it by crafting a malicious x86-64 binary that triggers the issue during decompilation, causing the decompile helper process to crash and disrupting analysis services.

Detection Guidance

Detecting this vulnerability requires checking the installed Ghidra version. Run 'ghidraVersion' or check the version in the Ghidra installation directory. If the version is 12.1.4 or earlier, the system is vulnerable. Additionally, monitor for crashes in the decompiler helper process during analysis of x86-64 binaries.

Impact Analysis

The vulnerability can cause denial of service by crashing the Ghidra decompiler process when analyzing a malicious binary. This disrupts reverse engineering tasks and automated analysis pipelines, potentially delaying security audits or malware analysis.

Compliance Impact

This vulnerability causes denial of service by crashing the decompiler helper process during analysis of malicious binaries. For compliance with standards like GDPR or HIPAA, which require thorough security analysis and vulnerability management, this disruption could impair an organization's ability to detect and respond to threats, potentially leading to non-compliance if critical security assessments are delayed or incomplete.

Mitigation Strategies
  • Upgrade Ghidra to a version later than 12.1.4 where the vulnerability has been patched.
  • Avoid processing untrusted x86-64 binaries in Ghidra until the update is applied.
  • Monitor decompiler processes for unexpected crashes during analysis tasks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100503. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart