Executive brief
Ghidra is a software reverse engineering suite used to analyze compiled code. A memory safety flaw in its C++ backend allows a specially crafted malicious binary to crash the application or potentially execute unauthorized code when a user attempts to decompile it. This primarily affects third-party tools and services that integrate Ghidra's SLEIGH library for code analysis.
Technical details
A heap-use-after-free vulnerability exists in Ghidra's SLEIGH C++ engine due to iterator invalidation. In SleighBuilder::generatePointerAdd, the code maintains a raw pointer to an element within a std::vector. When PcodeCacher::allocateInstruction calls emplace_back(), the vector may reallocate its internal buffer, rendering the original pointer dangling. Subsequent read/write operations on this pointer result in memory corruption. This is reachable via the public Sleigh::oneInstruction C++ API when processing malicious input. The issue is fixed in version 12.1.
Affected products
- NSA Ghidra < 12.1
Timeline
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: NVD publication date
References
- https://github.com/NationalSecurityAgency/ghidra/commit/8a3018d5efcb07d2ec40bacdd6063cb6f01c8edf
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-gqh9-2c72-wpjc
- https://www.vulncheck.com/advisories/ghidra-heap-use-after-free-in-sleighbuilder-generatepointeradd-via-vector-reallocation