Heap Out-of-Bounds Read in Ghidra Decompiler

Executive Summary

CVE-2026-100505 is a heap out-of-bounds read vulnerability in Ghidra versions 11.2 through 12.1.4. It occurs in the StringManager::getCodepoint function when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating the remaining buffer length. Attackers can craft malicious binaries to trigger out-of-bounds reads, causing crashes or leaking adjacent heap memory into decompiled output.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to Ghidra versions 11.2 through 12.1.4 and involves heap out-of-bounds reads during string decoding. Detection requires checking installed Ghidra versions and analyzing decompiler logs for crashes or memory leaks when processing malformed Unicode strings.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can crash the Ghidra decompiler or leak sensitive heap memory into decompiled output. If exploited, it may disrupt reverse engineering tasks, expose confidential data, or cause denial-of-service conditions during analysis of malicious binaries.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a heap out-of-bounds read in Ghidra's decompiler, which is a tool for reverse engineering. However, if Ghidra is used to analyze software handling sensitive data, a crash or memory leak could potentially expose personal or health information during analysis, indirectly impacting compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Ghidra to a version that includes the patch for CVE-2026-100505. The fix involves adding buffer length validation in the StringManager::getCodepoint function. Alternatively, avoid using affected Ghidra versions for processing untrusted binaries.

Useful 0 Not Useful 0