TI-2026-76933 Aliases CVE-2026-113604 GHSA-j4jr-xgjh-hpvc

Ghidra Denial of Service via ELF Loader Extended Header Counts

LOW 29CWE-789Published 2026-10-20 · Updated 2026-10-20

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-789.

Summary

Ghidra versions 10.2 through 12.1.4 contain a denial of service flaw in the ELF loader's ElfHeader class. It allocates arrays sized by extended section and program header counts that are not validated (CWE-789). A local user can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec discovery at import or in headless analysis pipelines.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec discovery at import or in headless analysis pipelines.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00163 5th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NationalSecurityAgency	ghidra	10.2 – 12.1.4	—	No fix listed	CNA

ghidra VendorNationalSecurityAgency Affected 10.2 – 12.1.4 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:nsa:ghidra::::::::	—	—	NationalSecurityAgency

cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:* Versions — — ·NationalSecurityAgency

Remediation

The sources list no fixed version for Ghidra.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-20 Threatist record created from CVE-2026-113604
2026-10-20 CISA SSVC decision points changed
2026-10-20 Priority changed: MEDIUM → LOW
2026-10-21 Alias added: GHSA-j4jr-xgjh-hpvc

References

Patch 1

https://github.com/NationalSecurityAgency/ghidra/commit/6c50a66e8a939e2bcbaf0a6432ec5d53a41ceeb3

Other 1

https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/elf/ElfHeader.java

TI-2026-39515 NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover CVSS 3.1CRITICAL 9.6
TI-2023-08846 Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes… CVSS 3.1CRITICAL 9.8
TI-2026-37876 Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search CVSS 4.0HIGH 8.7
TI-2026-27685 Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix CVSS 3.1HIGH 8.8
TI-2026-04310 NSA Ghidra Auto-Analysis Annotation Command Execution CVSS 3.1HIGH 8.8
TI-2026-37873 Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import CVSS 4.0HIGH 8.4

See all 53 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences