CVE-2026-96273: Ghidra before 12.1.4 Denial of Service via Crafted Database
Ghidra before 12.1.4 fails to validate the TYPECOL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and prevents resource cleanup or graceful shutdown.
Affected Software
Event History
Frequently Asked Questions
Which Ghidra installations are affected?
NSA Ghidra versions before 12.1.4 are affected. The issue is triggered during import of a crafted program database file.
What does an attacker need to exploit this issue?
An attacker needs to provide a malicious program database file and have a user import it into Ghidra. No privileges are required, but user interaction is required.
What is the operational impact after a malicious file is imported?
The malformed TYPE_COL byte causes an ArrayIndexOutOfBoundsException, leaving domain objects permanently locked. Ghidra can stall and may be unable to clean up resources or shut down gracefully.
How can exposure be reduced if an upgrade is not immediately possible?
Do not import program database files from untrusted sources until Ghidra can be updated to 12.1.4 or later. Treat unexpected stalls or inability to shut down cleanly following an import as a potential indicator of this issue.