Vulnerability

CVE-2026-100504

Descriptive record received from OpenCTI and minimised for consultation in the Intel portal.

Sharing: PUBLIC-OSINT
Confidence: 100
Source: The CVE Program
Updated: 26/09/2026 08:14

Description

Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled, corrupting memory and potentially achieving code execution.

STIX identifiervulnerability--3b34bde1-c7b9-5813-9547-6f8daab4df9e

First observation-

Last observation-

Known relationships9

Aliases and classifications

CWE-787Out-of-bounds Write

Minimised technical details

No raw data

cisa kev: False
cvss score: 7
cvss vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
cvss severity: HIGH

Provenance

Public references

Patch Commit
https://github.com/NationalSecurityAgency/ghidra/commit/6babe3c1cec7f5ec920dd16cdc86a02893e5b33c
VulnCheck Advisory: Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128
https://www.vulncheck.com/advisories/ghidra-through-12.1.4-stack-based-buffer-overflow-via-leftshift128
technical-description
https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/ruleaction.cc
Product Repository
https://github.com/NationalSecurityAgency/ghidra
technical-description
https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/multiprecision.cc

EudorIA correlation

Intel catalogue

The vulnerability is also available in the EudorIA editorial catalogue.

Open EudorIA analysis

Presence in OpenCTI describes an intelligence correlation and does not, by itself, constitute evidence of compromise, legal attribution or operational guidance applicable without context verification.