CVE-2026-45181 — Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block

title: CVE-2026-45181 - IDA Pro Clang Argument Injection to Plugin Directory
id: scw-2026-05-09-ai-1
status: experimental
level: high
description: |
  Detects the specific argument injection vulnerability in Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2. This rule looks for IDA Pro processes being launched with command-line arguments that include 'clang' and '.i64' files, indicative of an attempt to exploit CWE-88 by placing malicious code into a plugin directory.
author: SCW Feed Engine (AI-generated)
date: 2026-05-09
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-45181/
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
    category: process_creation
detection:
  selection:
      Image|startswith:
          - 'C:\Program Files\IDA Pro'
      CommandLine|contains:
          - '-plugin'
      CommandLine|contains:
          - '.i64'
      CommandLine|contains:
          - 'clang'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse