CVE-2026-45181: Hex-Rays IDA Pro RCE Vulnerability

CVE-2026-45181 Overview

CVE-2026-45181 is an argument injection vulnerability [CWE-88] in Hex-Rays IDA Pro versions 9.2 and 9.3 before 9.3sp2. The flaw exists because IDA Pro does not block Clang dependency-file generation when processing attacker-supplied .i64 database files. Attackers exploit this behavior to inject arguments that place malicious code into the IDA plugins directory. The next time the victim launches IDA Pro, the planted plugin loads automatically and executes attacker code in the user context.

Critical Impact
A reverse engineer who opens a malicious .i64 database file can have arbitrary code dropped into the IDA plugins directory, leading to code execution on subsequent IDA startup.

Affected Products

Hex-Rays IDA Pro 9.2
Hex-Rays IDA Pro 9.3 (before 9.3sp2)
Installations relying on Clang-based dependency-file generation in IDA

Discovery Timeline

2026-05-09 - CVE-2026-45181 published to the National Vulnerability Database
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-45181

Vulnerability Analysis

IDA Pro invokes Clang to generate dependency files as part of its processing pipeline. The product fails to sanitize or block command-line arguments derived from data embedded in .i64 database files. An attacker controlling the contents of a .i64 file can supply crafted strings that Clang interprets as additional arguments rather than benign input. These injected arguments cause Clang to write output files into directories of the attacker's choosing, including the IDA plugins directory. When IDA loads plugins on startup, the planted file runs with the privileges of the IDA user.

Exploitation requires the victim to open the attacker-supplied database. This delivery model is plausible because reverse engineers routinely share .i64 files for collaborative analysis on malware and crackmes.

Root Cause

The root cause is improper neutralization of arguments passed to an external program [CWE-88]. IDA Pro constructs Clang invocations using values that originate from untrusted database content without validating that those values cannot be interpreted as Clang flags. Clang accepts arguments such as -o and -MF that redirect output, which the injection turns into an arbitrary file write primitive.

Attack Vector

The attack vector is local and requires user interaction. The attacker distributes a malicious .i64 file through channels such as malware analysis collaboration, sample sharing, or CTF challenges. When the victim opens the file in a vulnerable IDA Pro version, the embedded payload triggers Clang dependency-file generation with attacker-controlled flags. Clang writes the attacker's content into the plugins directory. On the next IDA Pro launch, the plugin loader executes the file.

No synthetic exploit code is included. Technical details and a proof-of-concept are documented in the Calif.io blog on IDA bugs.

Detection Methods for CVE-2026-45181

Indicators of Compromise

Unexpected new files appearing in the IDA Pro plugins directory shortly after opening a .i64 file
Clang process invocations launched as child processes of ida.exe or ida64.exe with -o or -MF flags pointing outside expected build paths
.i64 files received from untrusted sources or sample-sharing platforms

Detection Strategies

Monitor process creation events where ida.exe, ida64.exe, or related IDA binaries spawn clang or clang.exe with suspicious output redirection arguments
Audit write activity to the IDA Pro plugins directory and alert on writes by processes other than installers or the IDA user
Hunt for .i64 files in download and email-attachment locations and correlate their open times with new files in the plugins directory

Monitoring Recommendations

Enable command-line logging for child processes of IDA Pro to capture full Clang argument lists
Track file integrity on %APPDATA%\Hex-Rays\IDA Pro\plugins and the installation plugins folder
Centralize endpoint telemetry to a security data platform to enable historical search after a suspicious .i64 is identified

How to Mitigate CVE-2026-45181

Immediate Actions Required

Upgrade IDA Pro to version 9.3sp2 or later as documented in the Hex-Rays Release Notes 9.3 SP2
Treat all third-party .i64 files as untrusted and analyze them in an isolated virtual machine
Inventory analyst workstations for IDA Pro 9.2 and 9.3 installations and prioritize their remediation

Patch Information

Hex-Rays addressed the issue in IDA Pro 9.3sp2 by blocking Clang dependency-file generation paths that allowed argument injection. Refer to the Hex-Rays Release Notes 9.3 SP2 for the official fix description and download links.

Workarounds

Do not open .i64 database files received from untrusted parties until the patch is applied
Run IDA Pro inside a disposable virtual machine when handling shared databases
Restrict write permissions on the IDA plugins directory so the analyst account cannot modify it during normal operation

bash

# Verify installed IDA Pro version and remove writable permissions on plugins directory (Windows PowerShell)
Get-ItemProperty "HKLM:\Software\Hex-Rays\IDA" | Select-Object DisplayVersion
icacls "C:\Program Files\IDA Pro 9.3\plugins" /inheritance:r
icacls "C:\Program Files\IDA Pro 9.3\plugins" /grant:r "Administrators:(OI)(CI)F" "Users:(OI)(CI)RX"