What is CVE-2026-49496?

CVE-2026-49496 is a medium-severity vulnerability in Nationalsecurityagency Ghidra, classified under Use After Free. CVSS score: 6.1/10. Published 2026-06-10.

How severe is CVE-2026-49496?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Use After Free in Nationalsecurityagency Ghidra

CVE-2026-49496

Ghidra before 12.1 contains a heap-use-after-free vulnerability in SleighBuilder::generatePointerAdd caused by iterator invalidation when PcodeCacher::allocateInstruction reallocates the issued vector. Attackers can trigger memory corruption by decompiling malicious binaries through the public Sleigh::oneInstruction C++ API, affecting downstream SLEIGH library consumers.

Vulnerability class: Use-After-Free

Published 2026-06-10 · last modified 2026-07-14.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H.

EPSS exploit prediction

EPSS: 0.002 (6.9th percentile), scored 2026-10-25.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 7th percentile — 6.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

Nationalsecurityagency Ghidra — versions 0, 12.1
Nsa Ghidra

Weakness classification (CWE)

CWE-416 — Use After Free

References

github.com/NationalSecurityAgency/ghidra/commit/8a3018d5efcb07d2ec40bacdd6063cb… (Patch, patch)
github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-gqh9-2c72-wpjc (Exploit, vendor-advisory, Vendor Advisory)
www.vulncheck.com/advisories/ghidra-heap-use-after-free-in-sleighbuilder-genera… (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2026-49496?: CVE-2026-49496 is a medium-severity vulnerability in Nationalsecurityagency Ghidra, classified under Use After Free. CVSS score: 6.1/10. Published 2026-06-10.
How severe is CVE-2026-49496?: Medium severity. CVSS v3 base score is 6.1 out of 10.