Is CVE-2026-49495 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49495 being exploited in the wild.

How severe is CVE-2026-49495?

Medium severity, with a CVSS score of 5.5, published 10 June 2026.

Which products and versions are affected?

National Security Agency Ghidra 10.2 to 12.0.4.

Is there a fix for CVE-2026-49495?

A patch was published on 2026-06-10: Fixed in version 12.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49495 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-49495?

Check whether you run National Security Agency Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49495: NSA Ghidra denial of service in Mach-O ExportTrie parser

CVE-2026-49495 · Severity: medium · CVSS 5.5 · Published 2026-06-10

Ghidra is a software reverse engineering suite used by security researchers to analyze programs. A vulnerability in how it processes certain Apple Mach-O files allows a specially crafted file to crash the entire application. If a user attempts to import a malicious file, Ghidra will run out of memory and shut down, resulting in the loss of all unsaved work across all open projects.

Technologies: National Security Agency Ghidra. Vendors: National Security Agency.

Quick answers

Is CVE-2026-49495 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49495 being exploited in the wild.
How severe is CVE-2026-49495?: Medium severity, with a CVSS score of 5.5, published 10 June 2026.
Which products and versions are affected?: National Security Agency Ghidra 10.2 to 12.0.4.
Is there a fix for CVE-2026-49495?: A patch was published on 2026-06-10: Fixed in version 12.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49495 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-49495?: Check whether you run National Security Agency Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An uncontrolled resource consumption vulnerability (CWE-835/CWE-770) exists in ExportTrie.parseTrie() due to a lack of cycle detection during Breadth-First Search (BFS) traversal of Mach-O export tries. An attacker can craft a Mach-O binary with circular references (e.g., a child node pointing back to the root at offset 0), leading to infinite loop iterations, unbounded queue growth, and exponential string concatenation. This eventually triggers an OutOfMemoryError (OOM). Because OOM is an Error rather than an Exception, it is not caught by Ghidra's standard error handling, causing the entire JVM process to terminate. The vulnerability is exploitable via local file import in both GUI and headless modes. A fix is available in Ghidra version 12.1 which implements visited-offset tracking.

Affected products

NSA Ghidra 10.2 to 12.0.4

Timeline

2026-05-14: advisory: GitHub Security Advisory published
2026-06-10: disclosed: CVE-2026-49495 published to NVD
2026-06-10: patched: Fixed in version 12.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.