CVE-2026-49497
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A path traversal vulnerability in Ghidra before version 12.1 in the SameDirDebugInfoProvider component allows attackers to inject traversal sequences into file paths. By crafting malicious ELF binaries with a .gnu_debuglink section, it is possible to probe filesystem existence and leak CRC32 hashes of arbitrary files during automatic DWARF analysis.
Risk Assessment
The risk involves potential remote disclosure of CRC32 hashes of system files, which could facilitate attacks based on file content knowledge (e.g., password brute-force) and reveal directory structure.
Recommendation
Immediately update Ghidra to version 12.1 or later, which includes a fix that validates filenames from the .gnu_debuglink section.
Original NVD description (English source)
Ghidra before 12.1 contains a path traversal vulnerability in SameDirDebugInfoProvider that fails to validate filenames from ELF binary .gnu_debuglink sections before constructing file paths. Attackers can craft malicious ELF binaries with traversal sequences to probe filesystem existence and leak CRC32 hashes of arbitrary files during automatic DWARF analysis.