Read the docs
TI-2026-33002 Aliases CVE-2026-45181GHSA-f88f-hghp-jjr6

Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file…

Priority LOW 30CWE-88Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-88.

Summary

Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via argument injection), which allows attackers to place their code into a plugins directory if the victim uses an attacker-supplied .i64 file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00159 5th percentileScored 2026-11-07
Fix Fixed IDA (Hex-Rays): 9.3sp2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hex-RaysIDA9.2 to before 9.3sp29.3sp2Patch availableCNA
  • IDA VendorHex-Rays Affected 9.2 to before 9.3sp2 Fixed in 9.3sp2 Patch available CNA

Remediation

  • Fix · CNA IDA (Hex-Rays) Fixed in 9.3sp2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45181
  2. 2026-10-03 Alias added: GHSA-f88f-hghp-jjr6

References

Other 2

  • TI-2024-29665 ida64.dll in Hex-Rays IDA Pro through 8.4 crashes when there is a section that has many… CVSS 3.1HIGH 7.5
  • TI-2014-07685 Heap-based buffer overflow in the GDB debugger module in Hex-Rays IDA Pro before 6.6… CVSS 2.0HIGH 10.0
  • TI-2011-00908 Unspecified vulnerability in the PEF input file loader in Hex-Rays IDA Pro 5.7 and 6.0… CVSS 2.0HIGH 10.0
  • TI-2011-00906 Integer overflow in the PSX/GEOS input file loaders in Hex-Rays IDA Pro 5.7 and 6.0 has… CVSS 2.0HIGH 10.0
  • TI-2011-00905 Integer overflow in the COFF/EPOC/EXPLOAD input file loaders in Hex-Rays IDA Pro 5.7 and… CVSS 2.0HIGH 10.0
  • TI-2011-00904 Unspecified vulnerability in Hex-Rays IDA Pro 5.7 and 6.0 has unknown impact and attack… CVSS 2.0HIGH 10.0
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences