Denial of Service Vulnerability in Ghidra by National Security Agency
CVE-2026-113604

6.8MEDIUM

Key Information:

Vendor

Nationalsecurityagency

Status
Ghidra
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113604?

Versions of Ghidra from 10.2 up to 12.1.4 are susceptible to a denial of service attack due to a flaw in the ELF loader's ElfHeader class. By providing a specially crafted 128-byte ELF file, attackers can exploit this vulnerability, resulting in an OutOfMemoryError during the loading process, which may be triggered in both import scenarios and in headless analysis operations. This issue arises from the allocation of arrays based on unvalidated extended section and program header counts, leaving the system open to resource exhaustion.

Affected Version(s)

ghidra 10.2 <= 12.1.4

References

https://github.com/NationalSecurityAgency/ghidra/commit/6...
patch
https://github.com/NationalSecurityAgency/ghidra/blob/Ghi...
technical-description
https://www.vulncheck.com/advisories/ghidra-10.2-through-...
third-party-advisory

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Asif Nadaf
.