Infinite loop in Ghidra - #VU144372
Published: August 19, 2026
Vulnerability identifier: #VU144372
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to loop with an unreachable exit condition in ElfHeader.deriveGnuHashDynamicSymbolCount() when parsing a crafted ELF binary during import. A remote attacker can trick the victim into opening a crafted ELF file to cause a denial of service.
The issue becomes unrecoverable because cancellation is disabled during parsing, and it affects both GUI and headless analysis.
Affected software
Ghidra
Remediation
Install security update from vendor's website.
Ghidra - update to 12.1.2