Denial of Service Vulnerability in Ghidra by National Security Agency
CVE-2026-96273

6.8MEDIUM

Key Information:

Vendor: Nationalsecurityagency
Status: Ghidra
Vendor: CVE Published:; 23 September 2026

🔔 Create Nationalsecurityagency Vulnerability Alert

What is CVE-2026-96273?

Ghidra, a software reverse engineering tool by the National Security Agency, contains a vulnerability that fails to properly validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(). This oversight causes an ArrayIndexOutOfBoundsException, which can lead to a denial of service situation. Attackers can exploit this vulnerability by crafting a malicious program database file. When this file is imported, it causes the application to stall, effectively locking domain objects and preventing any resource cleanup or graceful shutdown. This flaw is present in versions prior to 12.1.4, necessitating immediate attention from users to upgrade and mitigate potential exploitation.