Vulnerability · Published Jun 10, 2026 · Assigned by VulnCheck

CVE-2026-49496Ghidra < 12.1 - Heap-Use-After-Free in SleighBuilder::generatePointerAdd via Vector Reallocation

Medium 6.1

In plain English

A medium-severity use-after-free in ghidra from nationalsecurityagency. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 93.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Ghidra before 12.1 contains a heap-use-after-free vulnerability in SleighBuilder::generatePointerAdd caused by iterator invalidation when PcodeCacher::allocateInstruction reallocates the issued vector. Attackers can trigger memory corruption by decompiling malicious binaries through the public Sleigh::oneInstruction C++ API, affecting downstream SLEIGH library consumers.

Affected products (as reported)

Vendor	Product	Versions
nationalsecurityagency	ghidra	0 – before 12.1

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

References

GitHub Security Advisory (GHSA-gqh9-2c72-wpjc) vendor-advisory
Patch Commit patch
https://www.vulncheck.com/advisories/ghidra-heap-use-after-free-in-sleighbuilder-generatepointeradd-via-vector-reallocation third-party-advisory