EUVD-2026-109270

Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the...

CVE-2026-116012

Ghidra versions prior to 12.2 are vulnerable to a numeric truncation vulnerability (CWE-197) within the PackedDecode::skipAttribute and skipAttributeRemaining functions in marshal.cc . The root cause is the storage of 64-bit string lengths in 32-bit variables. An attacker can exploit this by prov...