CVE-2026-49497 MEDIUM

CVE-2026-49497: Ghidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolution

Vendor Nationalsecurityagency
Product ghidra
Weakness CWE-22 · Path traversal
Published June 10, 2026
Last update June 10, 2026
View on NVD All CVEs

CVSS base score

4.6/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Ghidra before 12.1 contains a path traversal vulnerability in SameDirDebugInfoProvider that fails to validate filenames from ELF binary .gnu_debuglink sections before constructing file paths. Attackers can craft malicious ELF binaries with traversal sequences to probe filesystem existence and leak CRC32 hashes of arbitrary files during automatic DWARF analysis.

Key dates

02Disclosure timeline

June 10, 2026 CVE published
June 10, 2026 Record updated