Asif Nadaf

**Name of the Vulnerable Software and Affected Versions** Ghidra versions 11.2 through 12.1.4 **Description** A heap out-of-bounds read occurs in the `StringManager::getCodepoint()` function when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating the remaining buffer length. An attacker can use malicious binaries containing constant byte stores that end in multi-byte lead units to trigger this issue, resulting in a decompiler crash or the leakage of adjacent heap memory into the decompiled output. **Recommendations** Update Ghidra to a version later than 12.1.4.