CVE-2026-100505 | CVSS: 4.4 | 严重级别: MEDIUM
Ghidra versions 11.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries with constant byte stores ending in multi-byte lead units to trigger out-of-bounds reads that crash the decompiler or leak adjacent heap memory into decompiled output.
参考链接:
• https://github.com/NationalSecurityAgency/ghidra
• https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5de
• https://github.com/NationalSecurityAgency/ghidra/commit/e37c57f3d9c29511a1860f0a
📌 数据来源: NVD 官方
⚠️ 合规声明: 本文内容仅用于网络安全合规学习、科研与授权测试用途。严禁用于任何未授权行为,违者自行承担全部法律责任。