What’s Vulnerable › Vulnerabilities

CVE-2026-45181

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-09 · updated 2026-07-24
• Weakness: CWE-88

Description

Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via argument injection), which allows attackers to place their code into a plugins directory if the victim uses an attacker-supplied .i64 file.

Affected products

• Hex-Rays IDA: from 9.2 before 9.3sp2 — fixed in 9.3sp2

How to fix

Upgrade to a fixed version: Hex-Rays IDA 9.3sp2. Check the vendor advisory for mitigations.

References

• https://blog.calif.io/p/using-ida-to-find-bugs-in-ida-with
• https://docs.hex-rays.com/release-notes/9_3sp2

Get alerted when CVE-2026-45181 or the next vulnerability affects your stack