Is CVE-2024-58350 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-58350 being exploited in the wild.

How severe is CVE-2024-58350?

Low severity, with a CVSS score of 2.9, published 10 June 2026.

Which products and versions are affected?

National Security Agency Ghidra < 11.2.

Is there a fix for CVE-2024-58350?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-58350 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2024-58350?

Check whether you run National Security Agency Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-58350: NSA Ghidra use after free in Sleigh backend shutdown

Q: Is there a fix for CVE-2024-58350?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2024-58350 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2024-58350?

Check whether you run National Security Agency Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-58350 · Severity: low · CVSS 2.9 · Published 2026-06-10

Ghidra is a software reverse engineering suite used to analyze compiled code. A flaw in its Sleigh decompiler component can cause the application to hang or crash when it is being closed. While this primarily affects the reliability of automated analysis pipelines, it could be used to cause a denial of service in environments where Ghidra is integrated into larger workflows.

Technologies: National Security Agency Ghidra. Vendors: National Security Agency.

Quick answers

Is CVE-2024-58350 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-58350 being exploited in the wild.
How severe is CVE-2024-58350?: Low severity, with a CVSS score of 2.9, published 10 June 2026.
Which products and versions are affected?: National Security Agency Ghidra < 11.2.
Is there a fix for CVE-2024-58350?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-58350 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2024-58350?: Check whether you run National Security Agency Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in the Sleigh backend of Ghidra due to a Static Initialization Order Fiasco (SIOF). Specifically, the destruction order of the 'SleighArchitecture::translators' and 'XmlArchitectureCapability' singletons is undefined because they reside in different translation units. If 'SleighArchitecture::translators' is destroyed first, the 'SleighArchitecture::shutdown' function attempts to iterate over memory that has already been deallocated. This results in the iterator processing garbage data, leading to an infinite loop or a crash (denial of service) during the shutdown process. The issue is fixed in Ghidra version 11.2.

Affected products

NSA Ghidra < 11.2

Timeline

2024-09-19: advisory: GitHub Security Advisory published
2026-06-10: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.