TI-2026-80081 Aliases CVE-2026-116012 GHSA-5r3f-xv7p-f23m

Ghidra Integer Truncation in PackedDecode::skipAttribute Decompiler Parser

LOW 10CWE-197Published 2026-10-24 · Updated 2026-11-05

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Ghidra before 12.2 contains a numeric truncation flaw (CWE-197) in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc, which store 64-bit string lengths in 32-bit variables. An attacker can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process. The CVSS 4.0 base score is 2.0 (LOW).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0021 11th percentileScored 2026-11-07

Fix Fixed ghidra (NationalSecurityAgency): 12.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NationalSecurityAgency	ghidra	before 12.2	12.2	Patch available	CNA

ghidra VendorNationalSecurityAgency Affected before 12.2 Fixed in 12.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:nsa:ghidra::::::::	—	—	NationalSecurityAgency

cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:* Versions — — ·NationalSecurityAgency

Remediation

Upgrade Ghidra to 12.2, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA ghidra (NationalSecurityAgency) Fixed in 12.2

Timeline

2026-10-24 Threatist record created from CVE-2026-116012
2026-10-24 Alias added: GHSA-5r3f-xv7p-f23m
2026-11-05 CISA SSVC decision points changed

References

Patch 1

https://github.com/NationalSecurityAgency/ghidra/commit/d105789b331dba84ad73ab92db890e38fe665be0

Advisory 1

GitHub Security Advisory (GHSA-v423-5vh7-c7jw)

Other 2

TI-2026-39515 NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover CVSS 3.1CRITICAL 9.6
TI-2023-08846 Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes… CVSS 3.1CRITICAL 9.8
TI-2026-37876 Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search CVSS 4.0HIGH 8.7
TI-2026-27685 Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix CVSS 3.1HIGH 8.8
TI-2026-04310 NSA Ghidra Auto-Analysis Annotation Command Execution CVSS 3.1HIGH 8.8
TI-2026-37873 Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import CVSS 4.0HIGH 8.4

See all 53 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences