CVE-2026-116012 Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116012?
CVE-2026-116012 is a low-severity vulnerability in NationalSecurityAgency ghidra, published on 24 Oct 2026.
Official description
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.
Weakness: CWE-197
Which versions are affected by CVE-2026-116012?
How do I fix CVE-2026-116012?
No fix has been published for CVE-2026-116012 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116012 being exploited?
There is no known exploitation of CVE-2026-116012 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-5r3f-xv7p-f23m, GHSA-v423-5vh7-c7jw.