CVE-2026-116012

The record

Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.

Affected packages

Related vulnerabilities

• CVE-2026-116742 HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in… CWE-197
• CVE-2026-115889 Wasmtime is a runtime for WebAssembly. CWE-197
• CVE-2026-70177 Numeric truncation error in Microsoft Windows Search Component allows an authorized… CWE-197
• CVE-2026-70123 Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to… CWE-197
• CVE-2026-96280 The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and… CWE-197
• CVE-2026-19667 If an attacker-controlled authoritative server can produce a negative answer that is… CWE-197
• CVE-2026-87529 Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a… CWE-197
• CVE-2026-68880 Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate… CWE-197