Vulnerability record · CVE-2026-100503 · published 26 September 2026

CVE-2026-100503: Nsa ghidra use after free vulnerability

Nsa · Ghidra

Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines.

4.8 CVSS 4.0 Medium EPSS 0.12% · top 98.4% CWE-416 · Use after free

4.8CVSS 4.0 base score

0.12%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

5References

8 Oct 2026Last modified by NVD

Description

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Ghidra Nsa

References

Link	Tags
https://github.com/NationalSecurityAgency/ghidra	Product
https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompile	Patch
https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompile	Patch
https://github.com/NationalSecurityAgency/ghidra/commit/5ef1ee4d7a25a65db195f3a70f681ca74440be61	Patch
https://www.vulncheck.com/advisories/ghidra-through-12.1.4-heap-use-after-free-in-decompiler	PatchThird Party Advisory

Track CVE-2026-100503 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-22671Nsa ghidra command injection vulnerabilityGhidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when ca…EPSS 2.9%6 Jan 2023 9.8CVE-2019-16941Nsa ghidra xml injection vulnerabilityNSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer i…EPSS 5.1%28 Sep 2019 9.1CVE-2019-13625Nsa ghidra xml external entity (xxe) vulnerabilityNSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file.EPSS 2.4%17 Jul 2019 8.8CVE-2026-4946Nsa ghidra os command injection vulnerabilityGhidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary comm…EPSS 0.77%29 Mar 2026 8.7CVE-2026-52758Nsa ghidra sql injection vulnerabilityGhidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries withou…EPSS 0.56%10 Jun 2026 8.7CVE-2026-52754Nsa ghidra improper verification of cryptographic signature vulnerabilityGhidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows any user with a valid CA-sig…EPSS 0.45%10 Jun 2026 8.7CVE-2026-49498Nsa ghidra sql injection vulnerabilityGhidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double…EPSS 0.47%10 Jun 2026 8.6CVE-2026-52751Nsa ghidra deserialization of untrusted data vulnerabilityGhidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated rem…EPSS 1.1%10 Jun 2026

Source: NIST National Vulnerability Database (record CVE-2026-100503), CISA KEV, FIRST EPSS (scores of 2026-10-14). This page is refreshed as NVD updates the record.