What’s Vulnerable › Vulnerabilities

CVE-2026-49497: Ghidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolution

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-10 · updated 2026-10-25
• Weakness: CWE-22

Description

Ghidra before 12.1 contains a path traversal vulnerability in SameDirDebugInfoProvider that fails to validate filenames from ELF binary .gnu_debuglink sections before constructing file paths. Attackers can craft malicious ELF binaries with traversal sequences to probe filesystem existence and leak CRC32 hashes of arbitrary files during automatic DWARF analysis.

Affected products

• nationalsecurityagency ghidra: before 12.1 — fixed in 12.1

How to fix

Upgrade to a fixed version: nationalsecurityagency ghidra 12.1. Check the vendor advisory for mitigations.

References

• https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-57g6-7qw2-p5hx
• https://www.vulncheck.com/advisories/ghidra-path-traversal-via-gnu-debuglink-in-dwarf-external-debug-file-resolution

Get alerted when CVE-2026-49497 or the next vulnerability affects your stack