CVE-2026-100503

MediumCVSS 5.5/10Last modified Oct 8, 2026

Description

Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
NationalSecurityAgency	ghidra	<= 12.1.4

References

Timeline

Published: Sep 26, 2026
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1005047.0Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when proces CVE-2026-1005054.4Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte U CVE-2026-1005067.2Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects W CVE-2026-1005077.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Co CVE-2026-1005085.3Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.CVE-2026-1005096.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations RepairBuddy computer-CVE-2026-100517.5In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the CVE-2026-1005107.1Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.CVE-2026-1005118.8Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Inj CVE-2026-1005129.8Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.CVE-2026-1005136.5Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions.CVE-2026-1005147.5Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.