PT-2026-39420 · Hex Rays · Ida Pro

Calif · Published 2026-05-09 · Updated 2026-05-10 · CVE-2026-45181

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Hex-Rays IDA Pro versions 9.2 through 9.3 Hex-Rays IDA Pro versions prior to 9.3sp2

Description An argument injection flaw exists where the software fails to block Clang dependency-file generation. This allows an attacker to place malicious code into a plugins directory if a victim opens a specially crafted .i64 file.

Recommendations Update Hex-Rays IDA Pro to version 9.3sp2 or later.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2026-45181

Affected Products

Ida Pro

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-45181 · Security Note
• https://t.me/cveNotify/162890 · Telegram Post
• https://twitter.com/CVEnew/status/2053537511331496004 · Twitter Post
• https://twitter.com/infoflowcloud/status/2053539738934563008 · Twitter Post
• https://docs.hex-rays.com/release-notes/9_3sp2 · Note
• https://t.me/CVEtracker/53251 · Telegram Post
• https://t.me/cveNotify/162923 · Telegram Post
• https://blog.calif.io/p/using-ida-to-find-bugs-in-ida-with · Note
• https://twitter.com/VulmonFeeds/status/2053280428094632270 · Twitter Post