CVE-2026-54389: Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb
Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters into an unbounded list, causing uncontrolled heap growth that triggers an OutOfMemoryError which bypasses exception handling and crashes the application.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Ghidra versions before 12.1.3 are exposed when they open or otherwise process an attacker-supplied PDB file. The issue is local and requires user interaction.
What does an attacker need to do to trigger the crash?
An attacker must provide a crafted PDB file containing an oversized parameters section. When Ghidra's AbstractPdb deserialization routine processes it, it reads remaining parameters into an unbounded list until heap exhaustion causes an OutOfMemoryError and terminates the process.
Is this a confidentiality or code-execution issue?
The provided impact information indicates availability impact only. Confidentiality and integrity impacts are listed as none.
How can I remediate the issue?
Upgrade Ghidra to version 12.1.3 or later. Until upgrading, avoid processing untrusted PDB files, particularly files from unverified sources.