CVE-2026-100504

Name of the Vulnerable Software and Affected Versions Ghidra versions prior to 12.1.5

Description A stack-based out-of-bounds write occurs in the decompiler's leftshift128() function when processing negative shift amounts from p-code. An attacker can craft malicious binaries with specific instruction sequences that trigger a memory overflow during decompilation, which may lead to memory corruption and potential code execution.

Recommendations Update to version 12.1.5 or later. As a temporary workaround, avoid decompiling untrusted binaries that may contain malicious p-code sequences.