Resource exhaustion in Ghidra - #VU158271
Published: October 28, 2026
Vulnerability identifier: #VU158271
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by exhausting heap memory and terminating the Ghidra client JVM.
The vulnerability exists due to uncontrolled resource consumption in DataBuffer.readExternal() when deserializing responses from a Ghidra RMI endpoint. A remote attacker can induce a victim to connect to an attacker-controlled endpoint, including by opening a prepared shared-project reference, and return a serialized DataBuffer with excessive length values to trigger array allocations that bypass the deserialization filter's array limit and terminate the client with OutOfMemoryError.
Affected software
Ghidra
Remediation
Install security update from vendor's website.
Ghidra - update to 12.2