SB2026102830 - Multiple vulnerabilities in Ghidra

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102830

SB2026102830 - Multiple vulnerabilities in Ghidra

Published: October 28, 2026

Security Bulletin ID SB2026102830
CSH Severity
High
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 22% Medium 78%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary operating system commands on the analyst's workstation with the analyst's privileges.

The vulnerability exists due to improper neutralization of embedded single quotes in Ghidra's ssh-gdbserver.sh debugger launcher when inserting the automatically populated Image value into a GDB pipe command executed through /bin/sh. A remote attacker can supply a program with a crafted extracted path that produces an Image value such as X'; touch '/tmp/GHIDRA_MARKER'; # and trick the analyst into selecting gdb + gdbserver via ssh, retaining that Image value, and clicking Launch to execute arbitrary local commands before SSH connects.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by exhausting the Ghidra JVM heap.

The vulnerability exists due to unbounded chained-fixup traversal and object allocation in Ghidra's Mach-O importer when processing dyld chained fixups. A remote attacker can induce a victim to import a specially crafted Mach-O file whose page starts trigger repeated traversal of the same underlying region, causing excessive DyldFixup object allocation to exhaust the JVM heap and terminate or destabilize the analysis process.


3) Link following (CVE-ID: N/A)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to recursively delete files with another user's privileges, causing data loss and denial of service.

The vulnerability exists due to improper symbolic link resolution in Ghidra's packed-database cleanup when processing temporary directories during startup. A local user can plant a directory symlink with a name matching ~tmp*.pdb.db in the cleanup directory and induce the victim to start Ghidra to delete the target directory's contents with the victim's privileges. The per-user temporary directory handling accepts an existing attacker-owned directory without verifying ownership, allowing the planted symlink to reach the cleanup routine.

The target directory's modification time must be at least one week old for cleanup to process it; selecting an older directory avoids the need for a race.


4) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to create or overwrite files outside the selected output directory under the Ghidra user's privileges, potentially executing arbitrary code or causing a denial of service.

The vulnerability exists due to path traversal in Ghidra's SplitMultiplePefContainersScript when constructing output paths from unchecked Code Fragment Manager member names. A remote attacker can trick a user into running the script on a crafted PEF data fork and AppleDouble resource fork containing a member name such as ../GHIDRA_CFRG_ESCAPE_MARKER.txt to write attacker-chosen bytes outside the selected directory. Writing to automatically loaded locations may execute code when the affected application or user session next starts, while destructive overwrites may prevent tools from starting.

Existing destination files trigger an overwrite confirmation, whereas new files are created without an additional path warning.


5) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by exhausting heap memory and terminating the Ghidra client JVM.

The vulnerability exists due to uncontrolled resource consumption in DataBuffer.readExternal() when deserializing responses from a Ghidra RMI endpoint. A remote attacker can induce a victim to connect to an attacker-controlled endpoint, including by opening a prepared shared-project reference, and return a serialized DataBuffer with excessive length values to trigger array allocations that bypass the deserialization filter's array limit and terminate the client with OutOfMemoryError.


6) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by exhausting the Java heap and aborting a Ghidra analysis run.

The vulnerability exists due to allocation of resources without limits in Ghidra's SquashFS filesystem parser when mounting an image with an unvalidated superblock inode_count. A remote attacker can trick an analyst into recursively importing a crafted 96-byte SquashFS image with inode_count=0x40000000 to trigger allocation of an array containing 1,073,741,825 references, exhausting the Java heap and aborting the analysis run.


7) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to exhaust JVM heap memory and cause a denial of service during Ghidra minidump import.

The vulnerability exists due to allocation of resources without limits in Ghidra's minidump parser when discovering load specifications for minidump files. A remote attacker can trick an analyst into importing a 32-byte .dmp file with NumberOfStreams=0x40000000 to trigger allocation of a 1,073,741,824-element directory array before the available directory entries are validated, exhausting heap memory and aborting the analysis run.


8) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through JVM heap exhaustion.

The vulnerability exists due to an infinite loop caused by accepting negative archive-member sizes without validating forward parser progress in Ghidra's COFF archive parser when processing an untrusted archive. A remote attacker can trick a victim into opening or recursively importing a crafted .a archive with a member size of -60, causing the parser to repeatedly parse and retain the same member header until the JVM exhausts its heap and aborts the analysis run.


9) Numeric Truncation Error (CVE-ID: CVE-2026-116012)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject arbitrary protocol elements into the decompiler's input stream and cause a denial of service.

The vulnerability exists due to integer truncation in the PackedDecode::skipAttribute and PackedDecode::skipAttributeRemaining functions when processing string attributes in the packed binary format. A remote attacker can craft input for a victim to process with an encoded string length such as 0x100000000, which is truncated from 64 bits to 32 bits, causing the parser to skip zero bytes and interpret attacker-controlled string content as legitimate attributes and elements, corrupting parser state and potentially causing crashes or undefined behavior.


Remediation

Install update from vendor's website.

References