{"id":"CVE-2026-116012","summary":"Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser","details":"Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.","aliases":["GHSA-v423-5vh7-c7jw"],"modified":"2026-10-25T07:11:30.878991420Z","published":"2026-10-24T11:40:30.825Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-197"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116012.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116012.json"},{"type":"PACKAGE","url":"https://github.com/NationalSecurityAgency/ghidra"},{"type":"ARTICLE","url":"https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Decompiler/src/decompile/cpp/marshal.cc#L641-L671"},{"type":"FIX","url":"https://github.com/NationalSecurityAgency/ghidra/commit/d105789b331dba84ad73ab92db890e38fe665be0"},{"type":"ADVISORY","url":"https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build"},{"type":"ADVISORY","url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v423-5vh7-c7jw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116012"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/ghidra-before-12.2-integer-truncation-in-packeddecode-skipattribute-decompiler-parser"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nationalsecurityagency/ghidra","events":[{"introduced":"0"},{"fixed":"8ca9077040cc43cd790babcfccf19475622a3e9a"},{"fixed":"d105789b331dba84ad73ab92db890e38fe665be0"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"12.2"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"fixed":"d105789b331dba84ad73ab92db890e38fe665be0"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"8ca9077040cc43cd790babcfccf19475622a3e9a"}],"source":"REFERENCES_TAG","original_tag":"Ghidra_12.2_build"}]}}],"versions":["Ghidra_10.3_build","Ghidra_9.0.1_build"],"database_specific":{"vanir_signatures_modified":"2026-10-25T07:11:30Z","source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-116012.json","vanir_signatures":[{"digest":{"function_hash":"35098355418340090819445447453425725897","length":717},"id":"CVE-2026-116012-0fec66f6","signature_type":"Function","signature_version":"v1","source":"https://github.com/nationalsecurityagency/ghidra/commit/8ca9077040cc43cd790babcfccf19475622a3e9a","target":{"function":"certificate","file":"Ghidra/Framework/Generic/src/test/java/ghidra/net/CertToolTest.java"},"deprecated":false},{"source":"https://github.com/nationalsecurityagency/ghidra/commit/8ca9077040cc43cd790babcfccf19475622a3e9a","target":{"function":"testPkcs7BundleImport","file":"Ghidra/Framework/Generic/src/test/java/ghidra/net/CertToolTest.java"},"deprecated":false,"digest":{"length":547,"function_hash":"79399721206663996822832979141586592611"},"id":"CVE-2026-116012-65cfe3dd","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/nationalsecurityagency/ghidra/commit/d105789b331dba84ad73ab92db890e38fe665be0","target":{"file":"Ghidra/Features/Decompiler/src/decompile/cpp/marshal.cc"},"deprecated":false,"digest":{"line_hashes":["17045066366632958970382596310960994231","245256763341833673962752254951965912742","93080129882036576946741037647502460002","157227583806813921252885832371051648676","17045066366632958970382596310960994231","245256763341833673962752254951965912742","93080129882036576946741037647502460002","157227583806813921252885832371051648676"],"threshold":0.9},"id":"CVE-2026-116012-79341ca7","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["222320940127169493782474282906290125102","72321773847227983407854271332936824527","144263013747034095107671374771825431109","336710527929783468757395210034319121124","142753109097189343564835199937859397392","187344603634577604895047994945375055658","4174189892957150070366995802546801593","312611606870255653314630899857206963846","97104238693422362815718223128782080133","337830716104768838951474364905170692087","109167190863602539280575897841095808674","64976650795033076015800729666197899899","332501394050701359083821295211266668604","182723386859815934083467161070328267328","163154494892193754618108421439207695741","88788387854193108843284841798664976168","228169540734090152261365618807293194765","230924198397012789617565327762625346531","85158868899266919115300447099787036898","148767883359069035844320795782810961528","128219341942996200327377299977180306503","116626003279469684309346633306864482107","188929165070388368464013510618646141322","312665971007993141762279861656209212573","230520458133359003813473499280091094757","150998969676802715593372749813568996850","241220000070131354957597456263461987996","141289340489876393225356149509527552600","230946087034084260041784442443878998996","171471411624852656114406395169514586091","12025612366875099026064142778464790581","196014976694521124551978951949667328289","202462418482135599451808625265026894660","60895330027268918575142105276355823859","240665342723158339730210555128503524985","334417461194141587763406497791141342910","133162135177699193987450594681309870498","60087459296783992434105258416426696088","310184437524515907561505200868137571040","137888225798075235875134167018901270653","300153688203137417898517837426474823656","305008590166855026378258567246405677785","124941650120139932834834717226965388603","161149148153736269638940970117039773758","190775470446340535734127164844626497654","90687336446837434255635954440659005491","114780722558269978480534210026419678728","308945042841025282660213057632200924277","70788933646603794255729784261373609769","35795367723879710511876090792693717327"],"threshold":0.9},"id":"CVE-2026-116012-8a92a401","signature_type":"Line","signature_version":"v1","source":"https://github.com/nationalsecurityagency/ghidra/commit/8ca9077040cc43cd790babcfccf19475622a3e9a","target":{"file":"Ghidra/Framework/Generic/src/test/java/ghidra/net/CertToolTest.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["325068785494750239573473001239236131105","833058592554272114527495853086858924","16218700605153506826884852640675202009","221045173559984169225807838916836405542","160618005127773452671586729056754228054","53793815327581763969015738616800076250","49455474808140333279214730041483532374","11977077509846616751534255685717503324"],"threshold":0.9},"id":"CVE-2026-116012-93422d8c","signature_type":"Line","signature_version":"v1","source":"https://github.com/nationalsecurityagency/ghidra/commit/d105789b331dba84ad73ab92db890e38fe665be0","target":{"file":"Ghidra/Features/Decompiler/src/decompile/cpp/marshal.hh"}},{"id":"CVE-2026-116012-9bb4e6db","signature_type":"Line","signature_version":"v1","source":"https://github.com/nationalsecurityagency/ghidra/commit/8ca9077040cc43cd790babcfccf19475622a3e9a","target":{"file":"Ghidra/Framework/Generic/src/test/java/ghidra/net/PKITestUtils.java"},"deprecated":false,"digest":{"line_hashes":["52260170192409646835285165401292709034","103971869609780822122085536082128779846","142898632721031646331993354072277700181","35551601623176545098590158866828933717","245409069975075909621496081723036693811","33921928000463531414537185765144460828","264179150465973511510176668117680361619","113372360150607665446348141516281879265","151958410683971495153535280478436364632","319423640246836754933700380065232343427","9941090939463034869389725621245527354","19804950111014302674687943968085813747","293305186831221734129230444977873527895"],"threshold":0.9}}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}]}