ghidra vulnerabilities
CVEs whose affected-version data names the ghidra package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
16 CVEsRSS
CVE-2026-116012Low· 3.6PoCGhidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, s…
CVE-2026-115398Medium· 5.5Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import…
CVE-2026-115394Medium· 5.5Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation
Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit length field. Attackers can persuade users to import a crafted GZF pa…
CVE-2026-115503Medium· 5.5Ghidra before 12.2 Denial of Service via Compressed Extension Archive
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bom…
CVE-2026-115395Medium· 5.5Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()
Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme a…
CVE-2026-115397Medium· 5.5Ghidra before 12.2 Denial of Service via Extension Archive Install
Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a …
CVE-2026-115396Medium· 5.5Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive
Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted …
CVE-2026-113604Medium· 5.5Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts
Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF …
CVE-2026-100505Medium· 4.4Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length
Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craf…
CVE-2026-100504High· 7.0Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code
Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific ins…
CVE-2026-100503Low· 3.3Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references
Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 …
CVE-2026-96273Medium· 5.5Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked
Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database f…
CVE-2026-54389Medium· 5.5Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section
Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPd…
CVE-2026-18718High· 7.0PoCGhidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path
Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a vict…
CVE-2026-52759Medium· 5.5PoCGhidra < 12.1.1 - Denial of Service via Uncontrolled Memory Allocation in Mach-O Parser
Ghidra before 12.1.1 contains an uncontrolled memory allocation vulnerability in the Mach-O binary parser that allows attackers to cause denial of service. An attacker can supply a crafted Mach-O binary with an arbitrarily large ncmds lo…
CVE-2026-4946High· 8.8Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI
Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotati…