Executive brief
Ghidra is a software reverse engineering suite used to analyze compiled code. A flaw in its Sleigh decompiler component can cause the application to hang or crash when it is being closed. While this primarily affects the reliability of automated analysis pipelines, it could be used to cause a denial of service in environments where Ghidra is integrated into larger workflows.
Technical details
A use-after-free vulnerability exists in the Sleigh backend of Ghidra due to a Static Initialization Order Fiasco (SIOF). Specifically, the destruction order of the 'SleighArchitecture::translators' and 'XmlArchitectureCapability' singletons is undefined because they reside in different translation units. If 'SleighArchitecture::translators' is destroyed first, the 'SleighArchitecture::shutdown' function attempts to iterate over memory that has already been deallocated. This results in the iterator processing garbage data, leading to an infinite loop or a crash (denial of service) during the shutdown process. The issue is fixed in Ghidra version 11.2.
Affected products
- NSA Ghidra < 11.2
Timeline
- 2024-09-19: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: NVD publication date