CVE-2026-100503

Ghidra through 12.1.4 Heap Use-After-Free in Decompiler

4.8 Medium

Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.12%Unchanged since Sep 26, 2026

What each source reports

CVE List Score used 4.8

Ghidra through 12.1.4 Heap Use-After-Free in Decompiler

Record: CVE-2026-100503
CVSS 4.0: 4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2026-87372 4.8

Record: EUVD-2026-87372
CVSS 4.0: 4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-7rr6-c8rx-m78p 4.8

Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's...

Record: GHSA-7rr6-c8rx-m78p
CVSS 4.0: 4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness: CWE-416
Updated: 2026-11-02

NVD 4.8

Record: CVE-2026-100503
CVSS 4.0: 4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSV 4.8

Ghidra through 12.1.4 Heap Use-After-Free in Decompiler

Record: CVE-2026-100503
CVSS 4.0: 4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness: CWE-416
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-100503 is a medium vulnerability (CVSS 4.8) in Nationalsecurityagency Ghidra, published September 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. No source names a fixed version.