CVE-2026-45181

MediumCVSS 6.5

Published: 09/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

Hex-Rays IDA Pro versions 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via argument injection), allowing attackers to place their code into a plugins directory if the victim uses an attacker-supplied .i64 file.

Risk Assessment

An attacker can execute arbitrary code in the context of IDA Pro, potentially leading to system compromise or data theft.

Recommendation

Update IDA Pro to version 9.3sp2 or later, which includes a fix blocking argument injection.

Original NVD description (English source)

Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via argument injection), which allows attackers to place their code into a plugins directory if the victim uses an attacker-supplied .i64 file.