Executive brief
Hex-Rays IDA Pro is a widely used tool for software reverse engineering and security analysis. A vulnerability in its Clang-based type parser allows an attacker to execute malicious code on a user's computer if the user opens a specially crafted IDA database (.i64) file. This could lead to a full system compromise or theft of sensitive research data when a security analyst examines a file provided by an untrusted source.
Technical details
An argument injection vulnerability exists in the 'idaclang' component of Hex-Rays IDA Pro. The software fails to properly sanitize the CLANG_ARGV netnode stored within IDA database (.i64) files, which is used to pass arguments to the Clang compiler during type parsing. An attacker can craft a database file containing malicious Clang flags such as -MD, -MF, and -MT to generate a Makefile dependency file. By redirecting this output to IDA's plugins directory and embedding Python code within the -MT argument, the attacker can plant a malicious plugin that IDA executes upon its next launch. This requires the victim to open the malicious database and trigger type parsing. The issue is resolved in version 9.3sp2 by implementing a strict allowlist for Clang compiler flags.
Affected products
- Hex-Rays IDA Pro 9.2, 9.3 before 9.3sp2
Timeline
- 2026-05-08: disclosed: Initial research blog post published by Calif.io
- 2026-05-09: advisory: CVE-2026-45181 published
- 2026-05-09: patched: Hex-Rays released IDA 9.3sp2 to address the issue