Known vulnerabilities in Ghidra

Software: Ghidra
Software CPE: cpe:2.3:a:nsa.gov:ghidra:*:*:*:*:*:*:*:*
Total vulnerabilities: 35
Public exploits: 2
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Ghidra Ghidra is affected by 35 known vulnerabilities: 1 critical, 5 high, 23 medium, 6 low Critical High Medium Low

Vulnerabilities (35)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU144380 - Heap-based Buffer Overflow
CWE-122 Medium
No
No
12.1.3 19.08.2026 SB20260819134
#VU144379 - Resource exhaustion
CWE-400 Medium
No
No
12.1.3 19.08.2026 SB20260819134
#VU144378 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 High
No
No
12.1.3 19.08.2026 SB20260819134
#VU144377 - Resource exhaustion
CVE-2026-54389
CWE-400 Medium
No
No
12.1.3 19.08.2026 SB20260819134
#VU144376 - Resource exhaustion
CWE-400 Medium
No
No
12.1.3 19.08.2026 SB20260819134
#VU144375 - Uncontrolled Search Path Element
CVE-2026-18718
CWE-427 Medium
No
No
12.1.3 19.08.2026 SB20260819134
#VU144374 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Medium
No
No
12.1.3 19.08.2026 SB20260819134
#VU144373 - Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-835 Medium
No
No
12.1.3 19.08.2026 SB20260819134
#VU144372 - Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-835 Medium
No
No
12.1.2 19.08.2026 SB20260819133
#VU144371 - Out-of-bounds write
CWE-787 Low
No
No
12.1.1 19.08.2026 SB20260819132
#VU144370 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CWE-470 High
No
No
12.1.1 19.08.2026 SB20260819132
#VU144369 - Resource exhaustion
CVE-2026-52759
CWE-400 Medium
No
No
12.1.1 19.08.2026 SB20260819132
#VU131582 - Use After Free
CWE-416 Medium
No
No
12.1 15.05.2026 SB20260515104
#VU131581 - Use After Free
CWE-416 Medium
No
No
12.1 15.05.2026 SB20260515104
#VU131580 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Medium
No
No
12.1 15.05.2026 SB20260515104
#VU131579 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Medium
No
No
12.1 15.05.2026 SB20260515104
#VU131578 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Medium
No
No
- 15.05.2026 SB2026051604
#VU131577 - Deserialization of Untrusted Data
CWE-502 High
No
No
12.1 15.05.2026 SB20260515104
#VU131576 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Low
No
No
12.1 15.05.2026 SB20260515104
#VU131575 - Allocation of Resources Without Limits or Throttling
CWE-770 Medium
No
No
12.1 15.05.2026 SB20260515104


Showing elements 1 - 20 out of 35