{"schema_version":"2","view":"grouped","data":[{"id":56292,"cve_ids":["CVE-2026-116012"],"payload":{"kind":"advisory","title":"Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser","summary":"Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.","evidence":"cve:CVE-2026-116012","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-116012","aliases":["CVE-2026-116012"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.6,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/nationalsecurityagency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-24T11:40:30.825Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v423-5vh7-c7jw","https://github.com/NationalSecurityAgency/ghidra/commit/d105789b331dba84ad73ab92db890e38fe665be0","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Decompiler/src/decompile/cpp/marshal.cc#L641-L671","https://www.vulncheck.com/advisories/ghidra-before-12.2-integer-truncation-in-packeddecode-skipattribute-decompiler-parser"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-24T11:40:30.825Z"}}},"related_cves":[{"value":"CVE-2026-116012","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:91b45ad1-5a40-402e-b992-b32a8cef7565","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116012","advisory_id":"91b45ad1-5a40-402e-b992-b32a8cef7565","event_types":["advisory"],"published_at":"2026-10-25T16:12:26.285387+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T11:40:30.825+00:00","detail_url":"/advisories/advisory%3A91b45ad1-5a40-402e-b992-b32a8cef7565","group":{"id":"advisory:91b45ad1-5a40-402e-b992-b32a8cef7565","revision":1,"primary_event_id":55815,"change":"published","superseded_by":[],"changed":{"id":55815,"cve_ids":["CVE-2026-116012"],"payload":{"kind":"advisory","title":"Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser","summary":"Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.","evidence":"cve:CVE-2026-116012","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-116012","aliases":["CVE-2026-116012"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.6,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/nationalsecurityagency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-24T11:40:30.825Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v423-5vh7-c7jw","https://github.com/NationalSecurityAgency/ghidra/commit/d105789b331dba84ad73ab92db890e38fe665be0","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Decompiler/src/decompile/cpp/marshal.cc#L641-L671","https://www.vulncheck.com/advisories/ghidra-before-12.2-integer-truncation-in-packeddecode-skipattribute-decompiler-parser"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-24T11:40:30.825Z"}}},"related_cves":[{"value":"CVE-2026-116012","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:91b45ad1-5a40-402e-b992-b32a8cef7565","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116012","advisory_id":"91b45ad1-5a40-402e-b992-b32a8cef7565","event_types":["advisory"],"published_at":"2026-10-25T16:12:26.285387+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T11:40:30.825+00:00","detail_url":"/events/55815"},"members":[{"id":55815,"cve_ids":["CVE-2026-116012"],"payload":{"kind":"advisory","title":"Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser","summary":"Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.","evidence":"cve:CVE-2026-116012","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-116012","aliases":["CVE-2026-116012"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":2,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.6,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/nationalsecurityagency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-24T11:40:30.825Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v423-5vh7-c7jw","https://github.com/NationalSecurityAgency/ghidra/commit/d105789b331dba84ad73ab92db890e38fe665be0","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Decompiler/src/decompile/cpp/marshal.cc#L641-L671","https://www.vulncheck.com/advisories/ghidra-before-12.2-integer-truncation-in-packeddecode-skipattribute-decompiler-parser"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-24T11:40:30.825Z"}}},"related_cves":[{"value":"CVE-2026-116012","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:91b45ad1-5a40-402e-b992-b32a8cef7565","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116012","advisory_id":"91b45ad1-5a40-402e-b992-b32a8cef7565","event_types":["advisory"],"published_at":"2026-10-25T16:12:26.285387+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T11:40:30.825+00:00","detail_url":"/events/55815"}]}},{"id":53510,"cve_ids":["CVE-2026-115398"],"payload":{"kind":"advisory","title":"Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount","summary":"Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.","evidence":"cve:CVE-2026-115398","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115398","aliases":["CVE-2026-115398"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-23T15:00:30.147Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vvp8-22p8-x954","https://github.com/NationalSecurityAgency/ghidra/commit/061ec06a79f4147267f6fc690b0dcf944b2d4957","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-tar-and-zip-file-system-mount"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-115398","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T14:48:35.318812Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:00:30.147Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:03.058Z"}}},"related_cves":[{"value":"CVE-2026-115398","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:39766180-640b-410a-a389-d9c2877f12e4","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115398","advisory_id":"39766180-640b-410a-a389-d9c2877f12e4","event_types":["advisory"],"published_at":"2026-10-25T14:55:01.624182+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:03.058+00:00","detail_url":"/advisories/advisory%3A39766180-640b-410a-a389-d9c2877f12e4","group":{"id":"advisory:39766180-640b-410a-a389-d9c2877f12e4","revision":1,"primary_event_id":53039,"change":"published","superseded_by":[],"changed":{"id":53039,"cve_ids":["CVE-2026-115398"],"payload":{"kind":"advisory","title":"Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount","summary":"Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.","evidence":"cve:CVE-2026-115398","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115398","aliases":["CVE-2026-115398"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-23T15:00:30.147Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vvp8-22p8-x954","https://github.com/NationalSecurityAgency/ghidra/commit/061ec06a79f4147267f6fc690b0dcf944b2d4957","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-tar-and-zip-file-system-mount"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-115398","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T14:48:35.318812Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:00:30.147Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:03.058Z"}}},"related_cves":[{"value":"CVE-2026-115398","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:39766180-640b-410a-a389-d9c2877f12e4","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115398","advisory_id":"39766180-640b-410a-a389-d9c2877f12e4","event_types":["advisory"],"published_at":"2026-10-25T14:55:01.624182+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:03.058+00:00","detail_url":"/events/53039"},"members":[{"id":53039,"cve_ids":["CVE-2026-115398"],"payload":{"kind":"advisory","title":"Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount","summary":"Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.","evidence":"cve:CVE-2026-115398","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115398","aliases":["CVE-2026-115398"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-23T15:00:30.147Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vvp8-22p8-x954","https://github.com/NationalSecurityAgency/ghidra/commit/061ec06a79f4147267f6fc690b0dcf944b2d4957","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-tar-and-zip-file-system-mount"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-115398","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T14:48:35.318812Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:00:30.147Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:03.058Z"}}},"related_cves":[{"value":"CVE-2026-115398","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:39766180-640b-410a-a389-d9c2877f12e4","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115398","advisory_id":"39766180-640b-410a-a389-d9c2877f12e4","event_types":["advisory"],"published_at":"2026-10-25T14:55:01.624182+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:03.058+00:00","detail_url":"/events/53039"}]}},{"id":53509,"cve_ids":["CVE-2026-115394"],"payload":{"kind":"advisory","title":"Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation","summary":"Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit length field. Attackers can persuade users to import a crafted GZF packed database file, triggering an OutOfMemoryError in PackedDatabase.open() that aborts the import and denies service.","evidence":"cve:CVE-2026-115394","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115394","aliases":["CVE-2026-115394"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","versionType":"custom","lessThanOrEqual":"12.2"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-23T15:00:37.926Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-q538-hhhf-5jxp","https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.2_build/Ghidra/Framework/DB/src/main/java/db/BinaryField.java#L105-L113","https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.2_build/Ghidra/Framework/DB/src/main/java/db/buffers/DataBuffer.java#L170-L174","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-through-12.2-denial-of-service-via-binaryfield-memory-allocation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-115394","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T14:48:33.610551Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:00:37.926Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:00.068Z"}}},"related_cves":[{"value":"CVE-2026-115394","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9982ac9e-2a81-4af0-a1a2-1caf5ee0ed0c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115394","advisory_id":"9982ac9e-2a81-4af0-a1a2-1caf5ee0ed0c","event_types":["advisory"],"published_at":"2026-10-25T14:55:00.818941+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:00.068+00:00","detail_url":"/advisories/advisory%3A9982ac9e-2a81-4af0-a1a2-1caf5ee0ed0c","group":{"id":"advisory:9982ac9e-2a81-4af0-a1a2-1caf5ee0ed0c","revision":1,"primary_event_id":53038,"change":"published","superseded_by":[],"changed":{"id":53038,"cve_ids":["CVE-2026-115394"],"payload":{"kind":"advisory","title":"Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation","summary":"Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit length field. Attackers can persuade users to import a crafted GZF packed database file, triggering an OutOfMemoryError in PackedDatabase.open() that aborts the import and denies service.","evidence":"cve:CVE-2026-115394","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115394","aliases":["CVE-2026-115394"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","versionType":"custom","lessThanOrEqual":"12.2"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-23T15:00:37.926Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-q538-hhhf-5jxp","https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.2_build/Ghidra/Framework/DB/src/main/java/db/BinaryField.java#L105-L113","https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.2_build/Ghidra/Framework/DB/src/main/java/db/buffers/DataBuffer.java#L170-L174","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-through-12.2-denial-of-service-via-binaryfield-memory-allocation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-115394","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T14:48:33.610551Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:00:37.926Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:00.068Z"}}},"related_cves":[{"value":"CVE-2026-115394","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9982ac9e-2a81-4af0-a1a2-1caf5ee0ed0c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115394","advisory_id":"9982ac9e-2a81-4af0-a1a2-1caf5ee0ed0c","event_types":["advisory"],"published_at":"2026-10-25T14:55:00.818941+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:00.068+00:00","detail_url":"/events/53038"},"members":[{"id":53038,"cve_ids":["CVE-2026-115394"],"payload":{"kind":"advisory","title":"Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation","summary":"Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit length field. Attackers can persuade users to import a crafted GZF packed database file, triggering an OutOfMemoryError in PackedDatabase.open() that aborts the import and denies service.","evidence":"cve:CVE-2026-115394","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115394","aliases":["CVE-2026-115394"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","versionType":"custom","lessThanOrEqual":"12.2"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-23T15:00:37.926Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-q538-hhhf-5jxp","https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.2_build/Ghidra/Framework/DB/src/main/java/db/BinaryField.java#L105-L113","https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.2_build/Ghidra/Framework/DB/src/main/java/db/buffers/DataBuffer.java#L170-L174","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-through-12.2-denial-of-service-via-binaryfield-memory-allocation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-115394","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T14:48:33.610551Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:00:37.926Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:00.068Z"}}},"related_cves":[{"value":"CVE-2026-115394","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9982ac9e-2a81-4af0-a1a2-1caf5ee0ed0c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115394","advisory_id":"9982ac9e-2a81-4af0-a1a2-1caf5ee0ed0c","event_types":["advisory"],"published_at":"2026-10-25T14:55:00.818941+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:00.068+00:00","detail_url":"/events/53038"}]}},{"id":52841,"cve_ids":["CVE-2026-115503"],"payload":{"kind":"advisory","title":"Ghidra before 12.2 Denial of Service via Compressed Extension Archive","summary":"Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.","evidence":"cve:CVE-2026-115503","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115503","aliases":["CVE-2026-115503"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:14:03.831Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mcjr-7qqr-m3w8","https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-compressed-extension-archive"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:03.831Z"}}},"related_cves":[{"value":"CVE-2026-115503","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8bdd913a-ea9a-4689-8ad3-cf3c14d38e14","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115503","advisory_id":"8bdd913a-ea9a-4689-8ad3-cf3c14d38e14","event_types":["advisory"],"published_at":"2026-10-25T14:43:54.233634+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:03.831+00:00","detail_url":"/advisories/advisory%3A8bdd913a-ea9a-4689-8ad3-cf3c14d38e14","group":{"id":"advisory:8bdd913a-ea9a-4689-8ad3-cf3c14d38e14","revision":1,"primary_event_id":52369,"change":"published","superseded_by":[],"changed":{"id":52369,"cve_ids":["CVE-2026-115503"],"payload":{"kind":"advisory","title":"Ghidra before 12.2 Denial of Service via Compressed Extension Archive","summary":"Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.","evidence":"cve:CVE-2026-115503","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115503","aliases":["CVE-2026-115503"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:14:03.831Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mcjr-7qqr-m3w8","https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-compressed-extension-archive"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:03.831Z"}}},"related_cves":[{"value":"CVE-2026-115503","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8bdd913a-ea9a-4689-8ad3-cf3c14d38e14","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115503","advisory_id":"8bdd913a-ea9a-4689-8ad3-cf3c14d38e14","event_types":["advisory"],"published_at":"2026-10-25T14:43:54.233634+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:03.831+00:00","detail_url":"/events/52369"},"members":[{"id":52369,"cve_ids":["CVE-2026-115503"],"payload":{"kind":"advisory","title":"Ghidra before 12.2 Denial of Service via Compressed Extension Archive","summary":"Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.","evidence":"cve:CVE-2026-115503","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115503","aliases":["CVE-2026-115503"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:14:03.831Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mcjr-7qqr-m3w8","https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-compressed-extension-archive"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:03.831Z"}}},"related_cves":[{"value":"CVE-2026-115503","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8bdd913a-ea9a-4689-8ad3-cf3c14d38e14","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115503","advisory_id":"8bdd913a-ea9a-4689-8ad3-cf3c14d38e14","event_types":["advisory"],"published_at":"2026-10-25T14:43:54.233634+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:03.831+00:00","detail_url":"/events/52369"}]}},{"id":52821,"cve_ids":["CVE-2026-115397"],"payload":{"kind":"advisory","title":"Ghidra before 12.2 Denial of Service via Extension Archive Install","summary":"Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a crafted extension archive with many files can exhaust filesystem inodes, causing project writes and other processes to fail.","evidence":"cve:CVE-2026-115397","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115397","aliases":["CVE-2026-115397"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:14:02.326Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-j5q9-fhqg-q995","https://github.com/NationalSecurityAgency/ghidra/commit/7cb4e778efb69acb1919f841ad46d0da36e77eeb","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-extension-archive-install"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:02.326Z"}}},"related_cves":[{"value":"CVE-2026-115397","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:07422136-9070-4f82-8e3b-69ef28ebad3e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115397","advisory_id":"07422136-9070-4f82-8e3b-69ef28ebad3e","event_types":["advisory"],"published_at":"2026-10-25T14:43:39.927412+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:02.326+00:00","detail_url":"/advisories/advisory%3A07422136-9070-4f82-8e3b-69ef28ebad3e","group":{"id":"advisory:07422136-9070-4f82-8e3b-69ef28ebad3e","revision":1,"primary_event_id":52349,"change":"published","superseded_by":[],"changed":{"id":52349,"cve_ids":["CVE-2026-115397"],"payload":{"kind":"advisory","title":"Ghidra before 12.2 Denial of Service via Extension Archive Install","summary":"Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a crafted extension archive with many files can exhaust filesystem inodes, causing project writes and other processes to fail.","evidence":"cve:CVE-2026-115397","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115397","aliases":["CVE-2026-115397"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:14:02.326Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-j5q9-fhqg-q995","https://github.com/NationalSecurityAgency/ghidra/commit/7cb4e778efb69acb1919f841ad46d0da36e77eeb","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-extension-archive-install"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:02.326Z"}}},"related_cves":[{"value":"CVE-2026-115397","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:07422136-9070-4f82-8e3b-69ef28ebad3e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115397","advisory_id":"07422136-9070-4f82-8e3b-69ef28ebad3e","event_types":["advisory"],"published_at":"2026-10-25T14:43:39.927412+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:02.326+00:00","detail_url":"/events/52349"},"members":[{"id":52349,"cve_ids":["CVE-2026-115397"],"payload":{"kind":"advisory","title":"Ghidra before 12.2 Denial of Service via Extension Archive Install","summary":"Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a crafted extension archive with many files can exhaust filesystem inodes, causing project writes and other processes to fail.","evidence":"cve:CVE-2026-115397","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115397","aliases":["CVE-2026-115397"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:14:02.326Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-j5q9-fhqg-q995","https://github.com/NationalSecurityAgency/ghidra/commit/7cb4e778efb69acb1919f841ad46d0da36e77eeb","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-extension-archive-install"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:02.326Z"}}},"related_cves":[{"value":"CVE-2026-115397","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:07422136-9070-4f82-8e3b-69ef28ebad3e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115397","advisory_id":"07422136-9070-4f82-8e3b-69ef28ebad3e","event_types":["advisory"],"published_at":"2026-10-25T14:43:39.927412+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:02.326+00:00","detail_url":"/events/52349"}]}},{"id":52820,"cve_ids":["CVE-2026-115396"],"payload":{"kind":"advisory","title":"Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive","summary":"Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.","evidence":"cve:CVE-2026-115396","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115396","aliases":["CVE-2026-115396"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"10.3","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:14:01.562Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-6mj8-x8x9-7gxq","https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-10.3-before-12.2-denial-of-service-via-compressed-theme-archive"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:01.562Z"}}},"related_cves":[{"value":"CVE-2026-115396","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e221529d-688e-4b60-b01f-fe63e695e7f9","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115396","advisory_id":"e221529d-688e-4b60-b01f-fe63e695e7f9","event_types":["advisory"],"published_at":"2026-10-25T14:43:39.111953+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:01.562+00:00","detail_url":"/advisories/advisory%3Ae221529d-688e-4b60-b01f-fe63e695e7f9","group":{"id":"advisory:e221529d-688e-4b60-b01f-fe63e695e7f9","revision":1,"primary_event_id":52348,"change":"published","superseded_by":[],"changed":{"id":52348,"cve_ids":["CVE-2026-115396"],"payload":{"kind":"advisory","title":"Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive","summary":"Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.","evidence":"cve:CVE-2026-115396","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115396","aliases":["CVE-2026-115396"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"10.3","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:14:01.562Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-6mj8-x8x9-7gxq","https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-10.3-before-12.2-denial-of-service-via-compressed-theme-archive"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:01.562Z"}}},"related_cves":[{"value":"CVE-2026-115396","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e221529d-688e-4b60-b01f-fe63e695e7f9","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115396","advisory_id":"e221529d-688e-4b60-b01f-fe63e695e7f9","event_types":["advisory"],"published_at":"2026-10-25T14:43:39.111953+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:01.562+00:00","detail_url":"/events/52348"},"members":[{"id":52348,"cve_ids":["CVE-2026-115396"],"payload":{"kind":"advisory","title":"Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive","summary":"Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.","evidence":"cve:CVE-2026-115396","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115396","aliases":["CVE-2026-115396"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"10.3","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:14:01.562Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-6mj8-x8x9-7gxq","https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-10.3-before-12.2-denial-of-service-via-compressed-theme-archive"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:01.562Z"}}},"related_cves":[{"value":"CVE-2026-115396","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e221529d-688e-4b60-b01f-fe63e695e7f9","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115396","advisory_id":"e221529d-688e-4b60-b01f-fe63e695e7f9","event_types":["advisory"],"published_at":"2026-10-25T14:43:39.111953+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:01.562+00:00","detail_url":"/events/52348"}]}},{"id":52819,"cve_ids":["CVE-2026-115395"],"payload":{"kind":"advisory","title":"Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()","summary":"Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme archive with many small files, exhausting inodes and disk space to deny service to the host.","evidence":"cve:CVE-2026-115395","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115395","aliases":["CVE-2026-115395"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"10.3","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:14:00.814Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-fvwx-pwq5-3738","https://github.com/NationalSecurityAgency/ghidra/commit/b0762c3e728a6a26d80ed4943c2efd53e2569120","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-10.3-before-12.2-denial-of-service-via-themereader-readziptheme"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:00.814Z"}}},"related_cves":[{"value":"CVE-2026-115395","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4fa1fca9-d2e8-404e-b1f8-244bdabaafb3","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115395","advisory_id":"4fa1fca9-d2e8-404e-b1f8-244bdabaafb3","event_types":["advisory"],"published_at":"2026-10-25T14:43:38.098105+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:00.814+00:00","detail_url":"/advisories/advisory%3A4fa1fca9-d2e8-404e-b1f8-244bdabaafb3","group":{"id":"advisory:4fa1fca9-d2e8-404e-b1f8-244bdabaafb3","revision":1,"primary_event_id":52347,"change":"published","superseded_by":[],"changed":{"id":52347,"cve_ids":["CVE-2026-115395"],"payload":{"kind":"advisory","title":"Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()","summary":"Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme archive with many small files, exhausting inodes and disk space to deny service to the host.","evidence":"cve:CVE-2026-115395","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115395","aliases":["CVE-2026-115395"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"10.3","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:14:00.814Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-fvwx-pwq5-3738","https://github.com/NationalSecurityAgency/ghidra/commit/b0762c3e728a6a26d80ed4943c2efd53e2569120","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-10.3-before-12.2-denial-of-service-via-themereader-readziptheme"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:00.814Z"}}},"related_cves":[{"value":"CVE-2026-115395","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4fa1fca9-d2e8-404e-b1f8-244bdabaafb3","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115395","advisory_id":"4fa1fca9-d2e8-404e-b1f8-244bdabaafb3","event_types":["advisory"],"published_at":"2026-10-25T14:43:38.098105+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:00.814+00:00","detail_url":"/events/52347"},"members":[{"id":52347,"cve_ids":["CVE-2026-115395"],"payload":{"kind":"advisory","title":"Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()","summary":"Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme archive with many small files, exhausting inodes and disk space to deny service to the host.","evidence":"cve:CVE-2026-115395","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115395","aliases":["CVE-2026-115395"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"10.3","lessThan":"12.2","versionType":"custom"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T19:14:00.814Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-fvwx-pwq5-3738","https://github.com/NationalSecurityAgency/ghidra/commit/b0762c3e728a6a26d80ed4943c2efd53e2569120","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-10.3-before-12.2-denial-of-service-via-themereader-readziptheme"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T19:14:00.814Z"}}},"related_cves":[{"value":"CVE-2026-115395","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4fa1fca9-d2e8-404e-b1f8-244bdabaafb3","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115395","advisory_id":"4fa1fca9-d2e8-404e-b1f8-244bdabaafb3","event_types":["advisory"],"published_at":"2026-10-25T14:43:38.098105+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:14:00.814+00:00","detail_url":"/events/52347"}]}},{"id":50619,"cve_ids":["CVE-2026-100503"],"payload":{"kind":"advisory","title":"Ghidra through 12.1.4 Heap Use-After-Free in Decompiler","summary":"Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines.","evidence":"cve:CVE-2026-100503","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100503","aliases":["CVE-2026-100503"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":4.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","versionType":"custom","lessThanOrEqual":"12.1.4"}],"packageURL":"pkg:github/nationalsecurityagency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T09:48:42.871Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/commit/5ef1ee4d7a25a65db195f3a70f681ca74440be61","https://github.com/NationalSecurityAgency/ghidra","https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/merge.cc#L462-L472","https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/subflow.cc#L2717-L2745","https://www.vulncheck.com/advisories/ghidra-through-12.1.4-heap-use-after-free-in-decompiler"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100503","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T17:23:50.475506Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T17:24:36.147Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T09:48:42.871Z"}}},"related_cves":[{"value":"CVE-2026-100503","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4e619aa8-62d2-4f55-8372-89ebc9919833","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100503","advisory_id":"4e619aa8-62d2-4f55-8372-89ebc9919833","event_types":["advisory"],"published_at":"2026-10-25T14:02:00.87201+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T00:36:31.894+00:00","detail_url":"/advisories/advisory%3A4e619aa8-62d2-4f55-8372-89ebc9919833","group":{"id":"advisory:4e619aa8-62d2-4f55-8372-89ebc9919833","revision":1,"primary_event_id":50147,"change":"published","superseded_by":[],"changed":{"id":50147,"cve_ids":["CVE-2026-100503"],"payload":{"kind":"advisory","title":"Ghidra through 12.1.4 Heap Use-After-Free in Decompiler","summary":"Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines.","evidence":"cve:CVE-2026-100503","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100503","aliases":["CVE-2026-100503"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":4.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","versionType":"custom","lessThanOrEqual":"12.1.4"}],"packageURL":"pkg:github/nationalsecurityagency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T09:48:42.871Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/commit/5ef1ee4d7a25a65db195f3a70f681ca74440be61","https://github.com/NationalSecurityAgency/ghidra","https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/merge.cc#L462-L472","https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/subflow.cc#L2717-L2745","https://www.vulncheck.com/advisories/ghidra-through-12.1.4-heap-use-after-free-in-decompiler"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100503","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T17:23:50.475506Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T17:24:36.147Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T09:48:42.871Z"}}},"related_cves":[{"value":"CVE-2026-100503","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4e619aa8-62d2-4f55-8372-89ebc9919833","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100503","advisory_id":"4e619aa8-62d2-4f55-8372-89ebc9919833","event_types":["advisory"],"published_at":"2026-10-25T14:02:00.87201+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T00:36:31.894+00:00","detail_url":"/events/50147"},"members":[{"id":50147,"cve_ids":["CVE-2026-100503"],"payload":{"kind":"advisory","title":"Ghidra through 12.1.4 Heap Use-After-Free in Decompiler","summary":"Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines.","evidence":"cve:CVE-2026-100503","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100503","aliases":["CVE-2026-100503"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":4.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","versionType":"custom","lessThanOrEqual":"12.1.4"}],"packageURL":"pkg:github/nationalsecurityagency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T09:48:42.871Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/commit/5ef1ee4d7a25a65db195f3a70f681ca74440be61","https://github.com/NationalSecurityAgency/ghidra","https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/merge.cc#L462-L472","https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/subflow.cc#L2717-L2745","https://www.vulncheck.com/advisories/ghidra-through-12.1.4-heap-use-after-free-in-decompiler"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100503","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T17:23:50.475506Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T17:24:36.147Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T09:48:42.871Z"}}},"related_cves":[{"value":"CVE-2026-100503","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4e619aa8-62d2-4f55-8372-89ebc9919833","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100503","advisory_id":"4e619aa8-62d2-4f55-8372-89ebc9919833","event_types":["advisory"],"published_at":"2026-10-25T14:02:00.87201+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T00:36:31.894+00:00","detail_url":"/events/50147"}]}},{"id":50618,"cve_ids":["CVE-2026-100504"],"payload":{"kind":"advisory","title":"Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128","summary":"Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled, corrupting memory and potentially achieving code execution.","evidence":"cve:CVE-2026-100504","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100504","aliases":["CVE-2026-100504"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.3,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","versionType":"custom","lessThanOrEqual":"12.1.4"}],"packageURL":"pkg:github/nationalsecurityagency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T09:48:43.541Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/commit/6babe3c1cec7f5ec920dd16cdc86a02893e5b33c","https://github.com/NationalSecurityAgency/ghidra","https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/multiprecision.cc#L29-L61","https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/ruleaction.cc#L7848-L7878","https://www.vulncheck.com/advisories/ghidra-through-12.1.4-stack-based-buffer-overflow-via-leftshift128"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100504","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T17:40:22.713904Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:40:31.876Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T09:48:43.541Z"}}},"related_cves":[{"value":"CVE-2026-100504","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8e36f244-e3ea-48b4-9665-462e89ce15b4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100504","advisory_id":"8e36f244-e3ea-48b4-9665-462e89ce15b4","event_types":["advisory"],"published_at":"2026-10-25T14:02:00.218506+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T00:36:32.604+00:00","detail_url":"/advisories/advisory%3A8e36f244-e3ea-48b4-9665-462e89ce15b4","group":{"id":"advisory:8e36f244-e3ea-48b4-9665-462e89ce15b4","revision":1,"primary_event_id":50146,"change":"published","superseded_by":[],"changed":{"id":50146,"cve_ids":["CVE-2026-100504"],"payload":{"kind":"advisory","title":"Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128","summary":"Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled, corrupting memory and potentially achieving code execution.","evidence":"cve:CVE-2026-100504","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100504","aliases":["CVE-2026-100504"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.3,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","versionType":"custom","lessThanOrEqual":"12.1.4"}],"packageURL":"pkg:github/nationalsecurityagency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T09:48:43.541Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/commit/6babe3c1cec7f5ec920dd16cdc86a02893e5b33c","https://github.com/NationalSecurityAgency/ghidra","https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/multiprecision.cc#L29-L61","https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/ruleaction.cc#L7848-L7878","https://www.vulncheck.com/advisories/ghidra-through-12.1.4-stack-based-buffer-overflow-via-leftshift128"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100504","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T17:40:22.713904Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:40:31.876Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T09:48:43.541Z"}}},"related_cves":[{"value":"CVE-2026-100504","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8e36f244-e3ea-48b4-9665-462e89ce15b4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100504","advisory_id":"8e36f244-e3ea-48b4-9665-462e89ce15b4","event_types":["advisory"],"published_at":"2026-10-25T14:02:00.218506+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T00:36:32.604+00:00","detail_url":"/events/50146"},"members":[{"id":50146,"cve_ids":["CVE-2026-100504"],"payload":{"kind":"advisory","title":"Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128","summary":"Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled, corrupting memory and potentially achieving code execution.","evidence":"cve:CVE-2026-100504","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100504","aliases":["CVE-2026-100504"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.3,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","versionType":"custom","lessThanOrEqual":"12.1.4"}],"packageURL":"pkg:github/nationalsecurityagency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-22T09:48:43.541Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/commit/6babe3c1cec7f5ec920dd16cdc86a02893e5b33c","https://github.com/NationalSecurityAgency/ghidra","https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/multiprecision.cc#L29-L61","https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/ruleaction.cc#L7848-L7878","https://www.vulncheck.com/advisories/ghidra-through-12.1.4-stack-based-buffer-overflow-via-leftshift128"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100504","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T17:40:22.713904Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:40:31.876Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T09:48:43.541Z"}}},"related_cves":[{"value":"CVE-2026-100504","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8e36f244-e3ea-48b4-9665-462e89ce15b4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100504","advisory_id":"8e36f244-e3ea-48b4-9665-462e89ce15b4","event_types":["advisory"],"published_at":"2026-10-25T14:02:00.218506+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T00:36:32.604+00:00","detail_url":"/events/50146"}]}},{"id":42766,"cve_ids":["CVE-2026-113604"],"payload":{"kind":"advisory","title":"Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts","summary":"Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec discovery at import or in headless analysis pipelines.","evidence":"cve:CVE-2026-113604","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-113604","aliases":["CVE-2026-113604"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"10.2","versionType":"custom","lessThanOrEqual":"12.1.4"}],"packageURL":"pkg:github/nationalsecurityagency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-20T16:19:49.190Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/commit/6c50a66e8a939e2bcbaf0a6432ec5d53a41ceeb3","https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/elf/ElfHeader.java","https://www.vulncheck.com/advisories/ghidra-10.2-through-12.1.4-denial-of-service-via-elf-loader-extended-header-counts"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-113604","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T16:19:40.402782Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T16:19:49.190Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-20T15:40:31.409Z"}}},"related_cves":[{"value":"CVE-2026-113604","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:14c25852-99ac-4d1d-adf8-56352383eb7b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113604","advisory_id":"14c25852-99ac-4d1d-adf8-56352383eb7b","event_types":["advisory"],"published_at":"2026-10-25T11:42:45.250458+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T15:40:31.409+00:00","detail_url":"/advisories/advisory%3A14c25852-99ac-4d1d-adf8-56352383eb7b","group":{"id":"advisory:14c25852-99ac-4d1d-adf8-56352383eb7b","revision":1,"primary_event_id":42372,"change":"published","superseded_by":[],"changed":{"id":42372,"cve_ids":["CVE-2026-113604"],"payload":{"kind":"advisory","title":"Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts","summary":"Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec discovery at import or in headless analysis pipelines.","evidence":"cve:CVE-2026-113604","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-113604","aliases":["CVE-2026-113604"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"10.2","versionType":"custom","lessThanOrEqual":"12.1.4"}],"packageURL":"pkg:github/nationalsecurityagency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-20T16:19:49.190Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/commit/6c50a66e8a939e2bcbaf0a6432ec5d53a41ceeb3","https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/elf/ElfHeader.java","https://www.vulncheck.com/advisories/ghidra-10.2-through-12.1.4-denial-of-service-via-elf-loader-extended-header-counts"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-113604","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T16:19:40.402782Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T16:19:49.190Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-20T15:40:31.409Z"}}},"related_cves":[{"value":"CVE-2026-113604","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:14c25852-99ac-4d1d-adf8-56352383eb7b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113604","advisory_id":"14c25852-99ac-4d1d-adf8-56352383eb7b","event_types":["advisory"],"published_at":"2026-10-25T11:42:45.250458+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T15:40:31.409+00:00","detail_url":"/events/42372"},"members":[{"id":42372,"cve_ids":["CVE-2026-113604"],"payload":{"kind":"advisory","title":"Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts","summary":"Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec discovery at import or in headless analysis pipelines.","evidence":"cve:CVE-2026-113604","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-113604","aliases":["CVE-2026-113604"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"10.2","versionType":"custom","lessThanOrEqual":"12.1.4"}],"packageURL":"pkg:github/nationalsecurityagency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-20T16:19:49.190Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/commit/6c50a66e8a939e2bcbaf0a6432ec5d53a41ceeb3","https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/elf/ElfHeader.java","https://www.vulncheck.com/advisories/ghidra-10.2-through-12.1.4-denial-of-service-via-elf-loader-extended-header-counts"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-113604","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T16:19:40.402782Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T16:19:49.190Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-20T15:40:31.409Z"}}},"related_cves":[{"value":"CVE-2026-113604","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:14c25852-99ac-4d1d-adf8-56352383eb7b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113604","advisory_id":"14c25852-99ac-4d1d-adf8-56352383eb7b","event_types":["advisory"],"published_at":"2026-10-25T11:42:45.250458+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T15:40:31.409+00:00","detail_url":"/events/42372"}]}},{"id":8657,"cve_ids":["CVE-2026-100505"],"payload":{"kind":"advisory","title":"Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager","summary":"Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries containing strings or constant byte stores that end in multi-byte lead units to trigger out-of-bounds reads that crash the decompiler or leak adjacent heap memory into decompiled output.","evidence":"cve:CVE-2026-100505","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100505","aliases":["CVE-2026-100505"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":4.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.4,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"9.2","versionType":"custom","lessThanOrEqual":"12.1.4"}],"packageURL":"pkg:github/nationalsecurityagency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-05T14:55:05.029Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/commit/e37c57f3d9c29511a1860f0a735df53131d403d7","https://github.com/NationalSecurityAgency/ghidra","https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/stringmanage.cc#L324-L410","https://www.vulncheck.com/advisories/ghidra-11.2-through-12.1.4-heap-out-of-bounds-read-via-stringmanager"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100505","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T14:01:09.982721Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T14:55:05.029Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-28T20:11:44.291Z"}}},"related_cves":[{"value":"CVE-2026-100505","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:60b11dd7-7378-49b7-a234-d6fd3f80a096","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100505","advisory_id":"60b11dd7-7378-49b7-a234-d6fd3f80a096","event_types":["advisory"],"published_at":"2026-10-24T23:04:42.040786+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T00:36:33.247+00:00","detail_url":"/advisories/advisory%3A60b11dd7-7378-49b7-a234-d6fd3f80a096","group":{"id":"advisory:60b11dd7-7378-49b7-a234-d6fd3f80a096","revision":1,"primary_event_id":8646,"change":"published","superseded_by":[],"changed":{"id":8646,"cve_ids":["CVE-2026-100505"],"payload":{"kind":"advisory","title":"Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager","summary":"Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries containing strings or constant byte stores that end in multi-byte lead units to trigger out-of-bounds reads that crash the decompiler or leak adjacent heap memory into decompiled output.","evidence":"cve:CVE-2026-100505","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100505","aliases":["CVE-2026-100505"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":4.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.4,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"9.2","versionType":"custom","lessThanOrEqual":"12.1.4"}],"packageURL":"pkg:github/nationalsecurityagency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-05T14:55:05.029Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/commit/e37c57f3d9c29511a1860f0a735df53131d403d7","https://github.com/NationalSecurityAgency/ghidra","https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/stringmanage.cc#L324-L410","https://www.vulncheck.com/advisories/ghidra-11.2-through-12.1.4-heap-out-of-bounds-read-via-stringmanager"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100505","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T14:01:09.982721Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T14:55:05.029Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-28T20:11:44.291Z"}}},"related_cves":[{"value":"CVE-2026-100505","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:60b11dd7-7378-49b7-a234-d6fd3f80a096","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100505","advisory_id":"60b11dd7-7378-49b7-a234-d6fd3f80a096","event_types":["advisory"],"published_at":"2026-10-24T23:04:42.040786+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T00:36:33.247+00:00","detail_url":"/events/8646"},"members":[{"id":8646,"cve_ids":["CVE-2026-100505"],"payload":{"kind":"advisory","title":"Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager","summary":"Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries containing strings or constant byte stores that end in multi-byte lead units to trigger out-of-bounds reads that crash the decompiler or leak adjacent heap memory into decompiled output.","evidence":"cve:CVE-2026-100505","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100505","aliases":["CVE-2026-100505"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":4.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.4,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"9.2","versionType":"custom","lessThanOrEqual":"12.1.4"}],"packageURL":"pkg:github/nationalsecurityagency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-10-05T14:55:05.029Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/commit/e37c57f3d9c29511a1860f0a735df53131d403d7","https://github.com/NationalSecurityAgency/ghidra","https://github.com/NationalSecurityAgency/ghidra/blob/8b6bbb857accdfa20dc5b2f5dea471178c2e9fbc/Ghidra/Features/Decompiler/src/decompile/cpp/stringmanage.cc#L324-L410","https://www.vulncheck.com/advisories/ghidra-11.2-through-12.1.4-heap-out-of-bounds-read-via-stringmanager"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100505","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T14:01:09.982721Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T14:55:05.029Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-28T20:11:44.291Z"}}},"related_cves":[{"value":"CVE-2026-100505","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:60b11dd7-7378-49b7-a234-d6fd3f80a096","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100505","advisory_id":"60b11dd7-7378-49b7-a234-d6fd3f80a096","event_types":["advisory"],"published_at":"2026-10-24T23:04:42.040786+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T00:36:33.247+00:00","detail_url":"/events/8646"}]}},{"id":5410,"cve_ids":["CVE-2026-54389"],"payload":{"kind":"advisory","title":"Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb","summary":"Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters into an unbounded list, causing uncontrolled heap growth that triggers an OutOfMemoryError which bypasses exception handling and crashes the application.","evidence":"cve:CVE-2026-54389","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-54389","aliases":["CVE-2026-54389"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.7,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.1.3","versionType":"semver"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"affected"}],"modified":"2026-10-01T15:20:02.391Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-f75p-8cqj-9v3g","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.1.3_build"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-54389","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-25T15:34:11.666359Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-25T15:34:30.502Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T15:20:02.391Z"}}},"related_cves":[{"value":"CVE-2026-54389","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:132d171d-1143-4f43-aa1e-cca66edffd29","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-54389","advisory_id":"132d171d-1143-4f43-aa1e-cca66edffd29","event_types":["advisory"],"published_at":"2026-10-24T22:07:58.505976+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-20T22:02:30.459+00:00","detail_url":"/advisories/advisory%3A132d171d-1143-4f43-aa1e-cca66edffd29","group":{"id":"advisory:132d171d-1143-4f43-aa1e-cca66edffd29","revision":1,"primary_event_id":5433,"change":"published","superseded_by":[],"changed":{"id":5433,"cve_ids":["CVE-2026-54389"],"payload":{"kind":"advisory","title":"Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb","summary":"Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters into an unbounded list, causing uncontrolled heap growth that triggers an OutOfMemoryError which bypasses exception handling and crashes the application.","evidence":"cve:CVE-2026-54389","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-54389","aliases":["CVE-2026-54389"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.7,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.1.3","versionType":"semver"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"affected"}],"modified":"2026-10-01T15:20:02.391Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-f75p-8cqj-9v3g","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.1.3_build"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-54389","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-25T15:34:11.666359Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-25T15:34:30.502Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T15:20:02.391Z"}}},"related_cves":[{"value":"CVE-2026-54389","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:132d171d-1143-4f43-aa1e-cca66edffd29","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-54389","advisory_id":"132d171d-1143-4f43-aa1e-cca66edffd29","event_types":["advisory"],"published_at":"2026-10-24T22:07:58.505976+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-20T22:02:30.459+00:00","detail_url":"/events/5433"},"members":[{"id":5433,"cve_ids":["CVE-2026-54389"],"payload":{"kind":"advisory","title":"Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb","summary":"Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters into an unbounded list, causing uncontrolled heap growth that triggers an OutOfMemoryError which bypasses exception handling and crashes the application.","evidence":"cve:CVE-2026-54389","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-54389","aliases":["CVE-2026-54389"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.7,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.1.3","versionType":"semver"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"affected"}],"modified":"2026-10-01T15:20:02.391Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-f75p-8cqj-9v3g","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.1.3_build"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-54389","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-25T15:34:11.666359Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-25T15:34:30.502Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T15:20:02.391Z"}}},"related_cves":[{"value":"CVE-2026-54389","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:132d171d-1143-4f43-aa1e-cca66edffd29","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-54389","advisory_id":"132d171d-1143-4f43-aa1e-cca66edffd29","event_types":["advisory"],"published_at":"2026-10-24T22:07:58.505976+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-20T22:02:30.459+00:00","detail_url":"/events/5433"}]}},{"id":3181,"cve_ids":["CVE-2026-96273"],"payload":{"kind":"advisory","title":"Ghidra before 12.1.4 Denial of Service via Unreleased Lock in OptionsDB","summary":"Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and prevents resource cleanup or graceful shutdown.","evidence":"cve:CVE-2026-96273","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-96273","aliases":["CVE-2026-96273"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.1.4","versionType":"semver"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:18:19.228Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-4w7g-wmg8-fgv5","https://github.com/NationalSecurityAgency/ghidra/commit/594da048431aab082a9da7c4a965874d07d33310","https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.3_build/Ghidra/Framework/Project/src/main/java/ghidra/framework/data/OptionsDB.java#L358-L366","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.1.4_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-before-12.1.4-denial-of-service-via-crafted-database"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-96273","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-23T13:46:33.318445Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-23T13:46:55.065Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-28T16:18:19.228Z"}}},"related_cves":[{"value":"CVE-2026-96273","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e2d58d1f-32d8-4972-b391-ff7f6efe3d23","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96273","advisory_id":"e2d58d1f-32d8-4972-b391-ff7f6efe3d23","event_types":["advisory"],"published_at":"2026-10-24T21:31:12.160536+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T00:29:51.18+00:00","detail_url":"/advisories/advisory%3Ae2d58d1f-32d8-4972-b391-ff7f6efe3d23","group":{"id":"advisory:e2d58d1f-32d8-4972-b391-ff7f6efe3d23","revision":1,"primary_event_id":3192,"change":"published","superseded_by":[],"changed":{"id":3192,"cve_ids":["CVE-2026-96273"],"payload":{"kind":"advisory","title":"Ghidra before 12.1.4 Denial of Service via Unreleased Lock in OptionsDB","summary":"Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and prevents resource cleanup or graceful shutdown.","evidence":"cve:CVE-2026-96273","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-96273","aliases":["CVE-2026-96273"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.1.4","versionType":"semver"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:18:19.228Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-4w7g-wmg8-fgv5","https://github.com/NationalSecurityAgency/ghidra/commit/594da048431aab082a9da7c4a965874d07d33310","https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.3_build/Ghidra/Framework/Project/src/main/java/ghidra/framework/data/OptionsDB.java#L358-L366","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.1.4_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-before-12.1.4-denial-of-service-via-crafted-database"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-96273","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-23T13:46:33.318445Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-23T13:46:55.065Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-28T16:18:19.228Z"}}},"related_cves":[{"value":"CVE-2026-96273","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e2d58d1f-32d8-4972-b391-ff7f6efe3d23","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96273","advisory_id":"e2d58d1f-32d8-4972-b391-ff7f6efe3d23","event_types":["advisory"],"published_at":"2026-10-24T21:31:12.160536+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T00:29:51.18+00:00","detail_url":"/events/3192"},"members":[{"id":3192,"cve_ids":["CVE-2026-96273"],"payload":{"kind":"advisory","title":"Ghidra before 12.1.4 Denial of Service via Unreleased Lock in OptionsDB","summary":"Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and prevents resource cleanup or graceful shutdown.","evidence":"cve:CVE-2026-96273","products":[{"name":{"value":"ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-96273","aliases":["CVE-2026-96273"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/NationalSecurityAgency/ghidra","vendor":"NationalSecurityAgency","product":"ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.1.4","versionType":"semver"}],"packageURL":"pkg:github/NationalSecurityAgency/ghidra","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:18:19.228Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-4w7g-wmg8-fgv5","https://github.com/NationalSecurityAgency/ghidra/commit/594da048431aab082a9da7c4a965874d07d33310","https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.3_build/Ghidra/Framework/Project/src/main/java/ghidra/framework/data/OptionsDB.java#L358-L366","https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.1.4_build","https://github.com/NationalSecurityAgency/ghidra","https://www.vulncheck.com/advisories/ghidra-before-12.1.4-denial-of-service-via-crafted-database"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-96273","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-23T13:46:33.318445Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-23T13:46:55.065Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-28T16:18:19.228Z"}}},"related_cves":[{"value":"CVE-2026-96273","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e2d58d1f-32d8-4972-b391-ff7f6efe3d23","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96273","advisory_id":"e2d58d1f-32d8-4972-b391-ff7f6efe3d23","event_types":["advisory"],"published_at":"2026-10-24T21:31:12.160536+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T00:29:51.18+00:00","detail_url":"/events/3192"}]}},{"id":885,"cve_ids":["CVE-2026-52759"],"payload":{"kind":"advisory","title":"Ghidra < 12.1.1 - Denial of Service via Uncontrolled Memory Allocation in Mach-O Parser","summary":"Ghidra before 12.1.1 contains an uncontrolled memory allocation vulnerability in the Mach-O binary parser that allows attackers to cause denial of service. An attacker can supply a crafted Mach-O binary with an arbitrarily large ncmds load command count value, forcing the parser to allocate excessive heap memory without validating file size, crashing the Ghidra JVM.","evidence":"cve:CVE-2026-52759","products":[{"name":{"value":"Ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-52759","aliases":["CVE-2026-52759"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.7,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Ghidra","product":"Ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.1.1","versionType":"semver"},{"status":"unaffected","version":"12.1.1","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-24T14:17:46.062Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v6c3-h9cp-3whf","https://www.vulncheck.com/advisories/ghidra-denial-of-service-via-uncontrolled-memory-allocation-in-mach-o-parser"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-52759","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-06-10T14:46:22.393924Z"}}}],"references":[{"url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v6c3-h9cp-3whf","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-06-10T14:46:25.860Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:17:46.062Z"}}},"related_cves":[{"value":"CVE-2026-52759","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a4936483-8024-4396-b624-d03d53ae7603","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52759","advisory_id":"a4936483-8024-4396-b624-d03d53ae7603","event_types":["advisory"],"published_at":"2026-10-24T20:52:23.447231+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-06-10T12:43:09.584+00:00","detail_url":"/advisories/advisory%3Aa4936483-8024-4396-b624-d03d53ae7603","group":{"id":"advisory:a4936483-8024-4396-b624-d03d53ae7603","revision":1,"primary_event_id":878,"change":"published","superseded_by":[],"changed":{"id":878,"cve_ids":["CVE-2026-52759"],"payload":{"kind":"advisory","title":"Ghidra < 12.1.1 - Denial of Service via Uncontrolled Memory Allocation in Mach-O Parser","summary":"Ghidra before 12.1.1 contains an uncontrolled memory allocation vulnerability in the Mach-O binary parser that allows attackers to cause denial of service. An attacker can supply a crafted Mach-O binary with an arbitrarily large ncmds load command count value, forcing the parser to allocate excessive heap memory without validating file size, crashing the Ghidra JVM.","evidence":"cve:CVE-2026-52759","products":[{"name":{"value":"Ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-52759","aliases":["CVE-2026-52759"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.7,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Ghidra","product":"Ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.1.1","versionType":"semver"},{"status":"unaffected","version":"12.1.1","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-24T14:17:46.062Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v6c3-h9cp-3whf","https://www.vulncheck.com/advisories/ghidra-denial-of-service-via-uncontrolled-memory-allocation-in-mach-o-parser"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-52759","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-06-10T14:46:22.393924Z"}}}],"references":[{"url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v6c3-h9cp-3whf","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-06-10T14:46:25.860Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:17:46.062Z"}}},"related_cves":[{"value":"CVE-2026-52759","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a4936483-8024-4396-b624-d03d53ae7603","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52759","advisory_id":"a4936483-8024-4396-b624-d03d53ae7603","event_types":["advisory"],"published_at":"2026-10-24T20:52:23.447231+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-06-10T12:43:09.584+00:00","detail_url":"/events/878"},"members":[{"id":878,"cve_ids":["CVE-2026-52759"],"payload":{"kind":"advisory","title":"Ghidra < 12.1.1 - Denial of Service via Uncontrolled Memory Allocation in Mach-O Parser","summary":"Ghidra before 12.1.1 contains an uncontrolled memory allocation vulnerability in the Mach-O binary parser that allows attackers to cause denial of service. An attacker can supply a crafted Mach-O binary with an arbitrarily large ncmds load command count value, forcing the parser to allocate excessive heap memory without validating file size, crashing the Ghidra JVM.","evidence":"cve:CVE-2026-52759","products":[{"name":{"value":"Ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-52759","aliases":["CVE-2026-52759"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.7,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Ghidra","product":"Ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.1.1","versionType":"semver"},{"status":"unaffected","version":"12.1.1","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-24T14:17:46.062Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v6c3-h9cp-3whf","https://www.vulncheck.com/advisories/ghidra-denial-of-service-via-uncontrolled-memory-allocation-in-mach-o-parser"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-52759","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-06-10T14:46:22.393924Z"}}}],"references":[{"url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v6c3-h9cp-3whf","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-06-10T14:46:25.860Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:17:46.062Z"}}},"related_cves":[{"value":"CVE-2026-52759","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a4936483-8024-4396-b624-d03d53ae7603","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52759","advisory_id":"a4936483-8024-4396-b624-d03d53ae7603","event_types":["advisory"],"published_at":"2026-10-24T20:52:23.447231+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-06-10T12:43:09.584+00:00","detail_url":"/events/878"}]}},{"id":857,"cve_ids":["CVE-2026-18718"],"payload":{"kind":"advisory","title":"Ghidra Swift Demangler Analyzer Arbitrary Code Execution via Project State","summary":"Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-supplied project, SwiftDemanglerAnalyzer restores the persisted Swift binary directory from project state and SwiftNativeDemangler executes the resolved binary without integrity or signature verification, causing attacker-controlled executables to run under the Ghidra process user with no prompt or confirmation.","evidence":"cve:CVE-2026-18718","products":[{"name":{"value":"Ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-18718","aliases":["CVE-2026-18718"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.1,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"National Security Agency","product":"Ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.1.2","versionType":"semver"},{"status":"unaffected","version":"12.1.3","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-24T14:17:18.442Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-pcfh-853f-q3gh","https://github.com/NationalSecurityAgency/ghidra/commit/c03a70d","https://github.com/NationalSecurityAgency/ghidra","https://github.com/sn0x-sharma/CVE-2026-18718","https://www.vulncheck.com/advisories/ghidra-swift-demangler-analyzer-arbitrary-code-execution-via-project-state","https://sn0xs-organization.gitbook.io/sn0x-order.org/bb-web-hunt/critical/how-i-found-a-0-day-in-ghidra-shared-project-file-became-a-code-execution-vector"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-18718","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-03T21:17:08.036410Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-03T21:19:20.952Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:17:18.442Z"}}},"related_cves":[{"value":"CVE-2026-18718","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a636ef17-dfc9-4efe-8d34-6db2d1160d11","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18718","advisory_id":"a636ef17-dfc9-4efe-8d34-6db2d1160d11","event_types":["advisory"],"published_at":"2026-10-24T20:52:06.267636+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-03T16:54:17.653+00:00","detail_url":"/advisories/advisory%3Aa636ef17-dfc9-4efe-8d34-6db2d1160d11","group":{"id":"advisory:a636ef17-dfc9-4efe-8d34-6db2d1160d11","revision":1,"primary_event_id":850,"change":"published","superseded_by":[],"changed":{"id":850,"cve_ids":["CVE-2026-18718"],"payload":{"kind":"advisory","title":"Ghidra Swift Demangler Analyzer Arbitrary Code Execution via Project State","summary":"Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-supplied project, SwiftDemanglerAnalyzer restores the persisted Swift binary directory from project state and SwiftNativeDemangler executes the resolved binary without integrity or signature verification, causing attacker-controlled executables to run under the Ghidra process user with no prompt or confirmation.","evidence":"cve:CVE-2026-18718","products":[{"name":{"value":"Ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-18718","aliases":["CVE-2026-18718"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.1,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"National Security Agency","product":"Ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.1.2","versionType":"semver"},{"status":"unaffected","version":"12.1.3","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-24T14:17:18.442Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-pcfh-853f-q3gh","https://github.com/NationalSecurityAgency/ghidra/commit/c03a70d","https://github.com/NationalSecurityAgency/ghidra","https://github.com/sn0x-sharma/CVE-2026-18718","https://www.vulncheck.com/advisories/ghidra-swift-demangler-analyzer-arbitrary-code-execution-via-project-state","https://sn0xs-organization.gitbook.io/sn0x-order.org/bb-web-hunt/critical/how-i-found-a-0-day-in-ghidra-shared-project-file-became-a-code-execution-vector"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-18718","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-03T21:17:08.036410Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-03T21:19:20.952Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:17:18.442Z"}}},"related_cves":[{"value":"CVE-2026-18718","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a636ef17-dfc9-4efe-8d34-6db2d1160d11","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18718","advisory_id":"a636ef17-dfc9-4efe-8d34-6db2d1160d11","event_types":["advisory"],"published_at":"2026-10-24T20:52:06.267636+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-03T16:54:17.653+00:00","detail_url":"/events/850"},"members":[{"id":850,"cve_ids":["CVE-2026-18718"],"payload":{"kind":"advisory","title":"Ghidra Swift Demangler Analyzer Arbitrary Code Execution via Project State","summary":"Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-supplied project, SwiftDemanglerAnalyzer restores the persisted Swift binary directory from project state and SwiftNativeDemangler executes the resolved binary without integrity or signature verification, causing attacker-controlled executables to run under the Ghidra process user with no prompt or confirmation.","evidence":"cve:CVE-2026-18718","products":[{"name":{"value":"Ghidra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-18718","aliases":["CVE-2026-18718"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.1,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"National Security Agency","product":"Ghidra","versions":[{"status":"affected","version":"0","lessThan":"12.1.2","versionType":"semver"},{"status":"unaffected","version":"12.1.3","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-24T14:17:18.442Z","provider":"cve","references":["https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-pcfh-853f-q3gh","https://github.com/NationalSecurityAgency/ghidra/commit/c03a70d","https://github.com/NationalSecurityAgency/ghidra","https://github.com/sn0x-sharma/CVE-2026-18718","https://www.vulncheck.com/advisories/ghidra-swift-demangler-analyzer-arbitrary-code-execution-via-project-state","https://sn0xs-organization.gitbook.io/sn0x-order.org/bb-web-hunt/critical/how-i-found-a-0-day-in-ghidra-shared-project-file-became-a-code-execution-vector"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-18718","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-03T21:17:08.036410Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-03T21:19:20.952Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:17:18.442Z"}}},"related_cves":[{"value":"CVE-2026-18718","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a636ef17-dfc9-4efe-8d34-6db2d1160d11","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18718","advisory_id":"a636ef17-dfc9-4efe-8d34-6db2d1160d11","event_types":["advisory"],"published_at":"2026-10-24T20:52:06.267636+00:00","technologies":["core-cve","ghidra"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-03T16:54:17.653+00:00","detail_url":"/events/850"}]}}],"next_after":56292,"next_before":857}