CVE-2026-100504 Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128

High 7.3 Published 26 Sep 2026 Updated 22 Oct 2026

Attackers can achieve code execution by crafting malicious binaries that trigger a stack-based buffer overflow in Ghidra's decompiler.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-100504?

CVE-2026-100504 is a high-severity memory corruption vulnerability in NationalSecurityAgency ghidra, published on 26 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled, corrupting memory and potentially achieving code execution.

Weakness: CWE-787

Which versions are affected by CVE-2026-100504?

It affects 1 product.

Products include Nsa Ghidra.

How do I fix CVE-2026-100504?

No fix has been published for CVE-2026-100504 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-100504 being exploited?

There is no known exploitation of CVE-2026-100504 in the wild and no public exploit code.

Sources

Also known as GHSA-m3q7-8jjf-cmcw.