Known vulnerabilities in Ghidra

Software: Ghidra
Software CPE: cpe:2.3:a:nsa.gov:ghidra:*:*:*:*:*:*:*:*
Total vulnerabilities: 37
Public exploits: 2
Known exploited (KEV): 1

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Ghidra Ghidra is affected by 37 known vulnerabilities: 1 critical, 5 high, 25 medium, 6 low Critical High Medium Low

Vulnerabilities (37)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU151852 - Improper Validation of Array Index
CVE-2026-96273
CWE-129 Medium
No
No
12.1.4 23.09.2026 SB2026092346
#VU151851 - Uncontrolled Recursion
CWE-674 Medium
No
No
12.1.4 23.09.2026 SB2026092346
#VU144380 - Heap-based Buffer Overflow
CWE-122 Medium
No
No
12.1.3 19.08.2026 SB20260819134
#VU144379 - Resource exhaustion
CWE-400 Medium
No
No
12.1.3 19.08.2026 SB20260819134
#VU144378 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 High
No
No
12.1.3 19.08.2026 SB20260819134
#VU144377 - Resource exhaustion
CVE-2026-54389
CWE-400 Medium
No
No
12.1.3 19.08.2026 SB20260819134
#VU144376 - Resource exhaustion
CWE-400 Medium
No
No
12.1.3 19.08.2026 SB20260819134
#VU144375 - Uncontrolled Search Path Element
CVE-2026-18718
CWE-427 Medium
No
No
12.1.4 19.08.2026 SB20260819134
#VU144374 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Medium
No
No
12.1.3 19.08.2026 SB20260819134
#VU144373 - Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-835 Medium
No
No
12.1.3 19.08.2026 SB20260819134
#VU144372 - Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-835 Medium
No
No
12.1.2 19.08.2026 SB20260819133
#VU144371 - Out-of-bounds write
CWE-787 Low
No
No
12.1.1 19.08.2026 SB20260819132
#VU144370 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CWE-470 High
No
No
12.1.1 19.08.2026 SB20260819132
#VU144369 - Resource exhaustion
CVE-2026-52759
CWE-400 Medium
No
No
12.1.1 19.08.2026 SB20260819132
#VU131578 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-52756
CWE-22 Medium
No
No
- 15.05.2026 SB2026051604
#VU131577 - Deserialization of Untrusted Data
CVE-2026-52751
CWE-502 High
No
No
12.1 15.05.2026 SB20260515104
#VU131576 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-49497
CWE-22 Low
No
No
12.1 15.05.2026 SB20260515104
#VU131575 - Allocation of Resources Without Limits or Throttling
CVE-2026-49495
CWE-770 Medium
No
No
12.1 15.05.2026 SB20260515104
#VU131574 - Improper Verification of Cryptographic Signature
CVE-2026-52754
CWE-347 Medium
No
No
12.1 15.05.2026 SB20260515104
#VU131573 - Command injection
CVE-2026-52750
CWE-77 Medium
No
No
12.1 15.05.2026 SB20260515104


Showing elements 1 - 20 out of 37