Allocation of Resources Without Limits or Throttling in Ghidra - #VU158268
Published: October 28, 2026
Vulnerability identifier: #VU158268
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by exhausting the Ghidra JVM heap.
The vulnerability exists due to unbounded chained-fixup traversal and object allocation in Ghidra's Mach-O importer when processing dyld chained fixups. A remote attacker can induce a victim to import a specially crafted Mach-O file whose page starts trigger repeated traversal of the same underlying region, causing excessive DyldFixup object allocation to exhaust the JVM heap and terminate or destabilize the analysis process.
Affected software
Ghidra
Remediation
Install security update from vendor's website.
Ghidra - update to 12.2