{"id":"CVE-2026-116012","title":"Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser","summary":"Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, s…","severity":"low","cvss":3.6,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-197"],"vendor":"NationalSecurityAgency","product":"ghidra","affected":["ghidra < 12.2"],"published":"2026-10-24","updated":"2026-10-24","sourceUpdated":"2026-10-24T11:40:30.825Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116012","references":[{"url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v423-5vh7-c7jw","label":"GitHub Security Advisory (GHSA-v423-5vh7-c7jw)"},{"url":"https://github.com/NationalSecurityAgency/ghidra/commit/d105789b331dba84ad73ab92db890e38fe665be0"},{"url":"https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","label":"ghidra Ghidra_12.2_build Release Notes"},{"url":"https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Decompiler/src/decompile/cpp/marshal.cc#L641-L671"},{"url":"https://www.vulncheck.com/advisories/ghidra-before-12.2-integer-truncation-in-packeddecode-skipattribute-decompiler-parser","label":"VulnCheck Advisory: Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser"}],"tags":["cve.org"],"ingestedAt":"2026-10-24T11:57:47.029Z","slug":"CVE-2026-116012","body":"## Overview\n\nGhidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.\n\n## Affected\n\n- `ghidra < 12.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":19.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}