CVE-2026-49495: Ghidra 10.2 < 12.1 - Denial of Service via Circular Reference in Mach-O Export Trie Parser
Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() that lacks cycle detection when traversing Mach-O binary export tries. A crafted Mach-O binary with circular references in the export trie causes unbounded queue growth and exponential string concatenation, triggering OutOfMemoryError that crashes the entire JVM and loses all unsaved work.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghidrato a version that resolves this vulnerability.Fixed in 12.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49495?
CVE-2026-49495 has a medium severity rating of 6.7.
What does CVE-2026-49495 affect?
CVE-2026-49495 affects Ghidra versions 10.2 before 12.1.
How do I fix CVE-2026-49495?
To fix CVE-2026-49495, upgrade Ghidra to version 12.1 or later.
What type of vulnerability is CVE-2026-49495?
CVE-2026-49495 is a denial of service vulnerability due to uncontrolled resource consumption.
What causes the vulnerability in CVE-2026-49495?
The vulnerability is caused by a lack of cycle detection when parsing Mach-O binary export tries.