CVE-2026-100504: Ghidra Decompiler RCE Vulnerability

CVE-2026-100504 Overview

CVE-2026-100504 is a stack-based out-of-bounds write vulnerability in Ghidra, the National Security Agency's open-source software reverse engineering suite. The flaw resides in the decompiler's leftshift128 function within multiprecision.cc and is triggered when the function processes negative shift amounts derived from p-code. An attacker who crafts a malicious binary containing specific instruction sequences can corrupt stack memory when a reverse engineer loads and decompiles the sample. Successful exploitation can lead to arbitrary code execution in the context of the Ghidra process. The vulnerability affects Ghidra versions through 12.1.4 and is tracked under [CWE-787: Out-of-bounds Write].

Critical Impact
Analysts opening untrusted binaries in Ghidra 12.1.4 or earlier can trigger memory corruption that may lead to code execution on the reverse engineer's workstation.

Affected Products

Ghidra versions through 12.1.4
Ghidra Decompiler component (multiprecision.cc, ruleaction.cc)
Fixed in Ghidra 12.2 branch (commit 6babe3c)

Discovery Timeline

2026-09-26 - CVE-2026-100504 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100504

Vulnerability Analysis

The vulnerability lives in the Ghidra decompiler's multi-precision arithmetic routines, which the decompiler uses to simulate arbitrary-width integer operations expressed in p-code. The leftshift128 helper performs a left shift on an extended-precision integer stored on the stack. The function assumes the shift amount sa is a non-negative value within the bit-width of the operand. When p-code transformations in RuleDivTermAdd::applyOp produce a negative shift amount, leftshift128 computes word and bit offsets that index outside the fixed-size stack buffer. The resulting write corrupts adjacent stack memory, including saved registers and return addresses, giving an attacker who controls the input binary influence over native execution within the decompiler process.

Root Cause

The root cause is a signed integer handling defect. The shift-amount variable n in RuleDivTermAdd::applyOp was declared as a signed int4, allowing values interpreted as negative to flow into leftshift. The leftshift routine performs no bounds check on the shift amount before using it as an array index, violating the implicit precondition that the shift is positive and smaller than the operand's bit width.

Attack Vector

Exploitation is local and requires user interaction. The target must open a crafted binary in Ghidra and invoke the decompiler on a function containing the triggering p-code sequence. No network exposure or elevated privileges are required to deliver the payload; distribution typically occurs through malware samples, CTF challenges, or supply-chain lures aimed at reverse engineers and incident responders.

text

// Ghidra security patch - multiprecision.cc
 ///
 /// \b in and \b out arrays are specified and can point to the same storage.
 /// \param num is the number 64-bit words in the extended precision integers
-/// \param in is the 128-bit value to shift
-/// \param out is the container for the 128-bit result
+/// \param in is the value to shift
+/// \param out is the container for the result
 /// \param sa is the number of bits to shift
 static void leftshift(int4 num,uint8 *in,uint8 *out,int4 sa)

Source: Ghidra Commit 6babe3c

text

// Ghidra security patch - ruleaction.cc
 int4 RuleDivTermAdd::applyOp(PcodeOp *op,Funcdata &data)
 
 {
-  int4 n;
+  uint4 n;
   OpCode shiftopc;
   PcodeOp *subop = findSubshift(op,n,shiftopc);
   if (subop == (PcodeOp *)0) return 0;

Source: Ghidra Commit 6babe3c. The patch changes the shift-amount type from signed int4 to unsigned uint4, preventing negative values from reaching leftshift.

Detection Methods for CVE-2026-100504

Indicators of Compromise

Unexpected crashes of the Ghidra decompiler process (decompile.exe or decompile) when analyzing a specific binary
Core dumps or stack smashing protector messages originating from the Ghidra decompiler child process
Child processes spawned by the Ghidra Java process or its native decompiler helper that do not match a normal analysis workflow

Detection Strategies

Hunt for process-creation events where the Ghidra decompiler native binary spawns shells, scripting interpreters, or network tools
Flag loading of binaries from unverified sources (email attachments, chat downloads, unknown repositories) immediately before Ghidra process activity
Correlate decompiler crashes with recently opened project files to identify weaponized samples under analysis

Monitoring Recommendations

Enable endpoint telemetry on analyst workstations to capture process lineage, memory protection violations, and file access by the Ghidra decompiler
Review Ghidra project directories for binaries introduced from external sources and verify integrity before analysis
Track Ghidra version inventory across reverse-engineering and malware-analysis teams to confirm all installations are on a patched release

How to Mitigate CVE-2026-100504

Immediate Actions Required

Upgrade Ghidra to a build that incorporates commit 6babe3c from the Ghidra_12.2 branch
Treat any binary from an untrusted source as potentially weaponized against the decompiler and analyze it only inside an isolated virtual machine
Audit analyst workstations to confirm no instances of Ghidra 12.1.4 or earlier remain in production use

Patch Information

The fix is contained in Ghidra commit 6babe3c1cec7f5ec920dd16cdc86a02893e5b33c, merged into the Ghidra_12.2 branch. The patch retypes the shift-amount variable in RuleDivTermAdd::applyOp to uint4 and generalizes the leftshift documentation to reflect broader operand widths. Users should download the patched release from the Ghidra GitHub repository or build from source. Full technical context is available in the VulnCheck Ghidra Advisory.

Workarounds

Perform decompilation only on binaries received from trusted provenance until the upgrade is applied
Run Ghidra inside a disposable virtual machine or container that lacks access to sensitive credentials, source code, or production networks
Disable auto-analysis on import and manually select which functions to decompile when triaging unknown samples

bash

# Verify installed Ghidra version and confirm the patched commit is present
cat $GHIDRA_INSTALL_DIR/Ghidra/application.properties | grep application.version

# When building from source, confirm the fix commit is in the current branch
cd ghidra
git log --oneline 6babe3c1cec7f5ec920dd16cdc86a02893e5b33c -1