Is CVE-2026-113604 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113604 being exploited in the wild.

How severe is CVE-2026-113604?

Medium severity, with a CVSS score of 5.5, published 20 October 2026.

Which products and versions are affected?

Nsa Ghidra 10.2 through 12.1.4.

Is there a fix for CVE-2026-113604?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-113604 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-113604?

Check whether you run Nsa Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113604: NSA Ghidra ELF loader denial of service via unvalidated header counts

CVE-2026-113604 · Severity: medium · CVSS 5.5 · Published 2026-10-20

Ghidra is a reverse-engineering toolkit used by security analysts to inspect and understand software binaries. A flaw in its ELF file loader allows attackers to crash Ghidra by providing a specially crafted 128-byte file that exhausts available memory during analysis. This can disrupt security research workflows, particularly in automated scanning pipelines.

Technologies: Nsa Ghidra. Vendors: Nsa.

Quick answers

Is CVE-2026-113604 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113604 being exploited in the wild.
How severe is CVE-2026-113604?: Medium severity, with a CVSS score of 5.5, published 20 October 2026.
Which products and versions are affected?: Nsa Ghidra 10.2 through 12.1.4.
Is there a fix for CVE-2026-113604?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-113604 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-113604?: Check whether you run Nsa Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ElfHeader class allocates arrays based on unvalidated extended section and program header counts from ELF headers, without checking if the requested array sizes are reasonable. An attacker supplies a crafted ELF binary with abnormally large header counts, triggering an OutOfMemoryError when Ghidra attempts to load or analyze the file. No authentication or special privileges are required; the vulnerability triggers during normal file import or headless analysis operations.

Affected products

NSA Ghidra 10.2 through 12.1.4

Timeline

2026-10-20: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.