Executive brief
Ghidra is a popular reverse-engineering tool used by security researchers to analyze software. A vulnerability in its decompiler component allows an attacker to craft a malicious binary file that, when opened by a user, causes the application to access memory it has already released. This can lead to application crashes, incorrect analysis results, or potentially more severe security compromises of the researcher's workstation.
Technical details
A heap-use-after-free (UAF) vulnerability exists in the Ghidra decompiler's HighVariable::merge() function during the variable merging pass. The root cause is an asymmetric cleanup in the HighIntersectTest::highedgemap cache; when moveIntersectTests() is called, it may fail to remove reverse entries for a HighVariable, leaving orphaned pointers. When the associated HighVariable object is subsequently deleted via mergeInternal(), these stale pointers remain in the cache. A later call to moveIntersectTests() dereferences these pointers to read or write the 'flags' field of the freed memory. This is reachable via the standard Java-to-native IPC path when a user opens a binary in the decompiler view or uses analyzeHeadless. The issue is fixed in Ghidra version 12.1.
Affected products
- NSA Ghidra < 12.1
Timeline
- 2026-05-15: advisory: GitHub Security Advisory published by NSA
- 2026-06-10: disclosed: NVD publication date