Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100505Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager

Medium 4.4

In plain English

A medium-severity out-of-bounds read in ghidra from NationalSecurityAgency. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)0.1%top 96.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries containing strings or constant byte stores that end in multi-byte lead units to trigger out-of-bounds reads that crash the decompiler or leak adjacent heap memory into decompiled output.

Affected products (as reported)

Vendor	Product	Versions
NationalSecurityAgency	ghidra	9.2 – through 12.1.4

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

References

Patch Commit patch
https://github.com/NationalSecurityAgency/ghidra product
https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/stringmanage.cc#L324-L410 technical-description
VulnCheck Advisory: Ghidra 11.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager third-party-advisory