---
id: CVE-2026-116012
title: >-
  Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute
  Decompiler Parser
summary: >-
  Ghidra before 12.2 contains a numeric truncation vulnerability in
  PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that
  stores 64-bit string lengths in 32-bit variables. Attackers can supply a
  crafted packed stream, s…
severity: low
cvss: 3.6
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-197
vendor: NationalSecurityAgency
product: ghidra
affected:
  - ghidra < 12.2
published: '2026-10-24'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T11:40:30.825Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116012'
references:
  - url: >-
      https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v423-5vh7-c7jw
    label: GitHub Security Advisory (GHSA-v423-5vh7-c7jw)
  - url: >-
      https://github.com/NationalSecurityAgency/ghidra/commit/d105789b331dba84ad73ab92db890e38fe665be0
  - url: >-
      https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build
    label: ghidra Ghidra_12.2_build Release Notes
  - url: >-
      https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Decompiler/src/decompile/cpp/marshal.cc#L641-L671
  - url: >-
      https://www.vulncheck.com/advisories/ghidra-before-12.2-integer-truncation-in-packeddecode-skipattribute-decompiler-parser
    label: >-
      VulnCheck Advisory: Ghidra before 12.2 Integer Truncation in
      PackedDecode::skipAttribute Decompiler Parser
tags:
  - cve.org
ingestedAt: '2026-10-24T11:57:47.029Z'
---

## Overview

Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.

## Affected

- `ghidra < 12.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.