SB20260819134 - Multiple vulnerabilities in Ghidra

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260819134

SB20260819134 - Multiple vulnerabilities in Ghidra

Published: August 19, 2026

Security Bulletin ID SB20260819134
CSH Severity
High
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 13% Medium 88%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the PEF loader when parsing a crafted PEF file during import. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

User interaction is required to open or import the crafted PEF file.


2) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in XmlLoader program XML import (MEMORY_MAP -> MEMORY_CONTENTS) when parsing attacker-supplied program XML files during import. A remote attacker can trick the victim into importing a crafted XML file to disclose sensitive information.

User interaction is required to import the crafted XML file, and valid input must include the declaration for the vulnerable code path to be reached.


3) Insecure DLL loading (CVE-ID: CVE-2026-18718)

CWE-ID: CWE-427 - Uncontrolled Search Path Element

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to uncontrolled search path element in the Swift demangler analyzer path when processing a project or workspace state that resolves the configured Swift tool directory to attacker-controlled content. A remote attacker can supply a malicious binary in that directory to execute arbitrary code.

User interaction is required to open a crafted project or otherwise reach analysis of the Swift demangler path.


4) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in DyldCacheHeader during load-spec discovery when parsing a crafted dyld shared cache file. A local user can provide a specially crafted file with an inflated mappingCount value to cause a denial of service.

User interaction is required to import the crafted file through the GUI or headless import path.


5) Resource exhaustion (CVE-ID: CVE-2026-54389)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in AbstractPdb.deserializeParameters() when parsing a crafted PDB file. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

User interaction is required to open or process a crafted PDB file, including in headless batch pipelines handling untrusted PE+PDB pairs.


6) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to path traversal in AndroidProjectCreator \"Export to Eclipse Project\" action when processing a crafted .apk file. A remote attacker can trick the victim into exporting a crafted APK to execute arbitrary code.

User interaction is required to open an attacker-supplied APK and trigger the export action. The issue can also be abused to overwrite arbitrary user-writable files outside the selected output directory.


7) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in ObjectStorageStreamAdapter when opening a crafted trace database. A remote attacker can supply a crafted trace database with a large array size value to cause a denial of service.

User interaction is required to open the crafted file.


8) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service or modify memory.

The vulnerability exists due to a heap-based buffer overflow in TypeFactory::getBase() when processing a crafted binary during jump table recovery. A remote attacker can trick the victim into opening a crafted binary to cause a denial of service or modify memory.

User interaction is required to open the crafted binary or run headless analysis on it.


Remediation

Install update from vendor's website.

References