CVE-2026-45181: Hex-Rays Ida

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via argument injection), which allows attackers to place their code into a plugins directory if the victim uses an attacker-supplied .i64 file.

Affected products

• Hex-Rays Ida: from 9.2, before 9.3sp2 (fixed in 9.3sp2)

Published 2026-05-09. Last modified 2026-07-24.