Executive brief
Ghidra is a software reverse engineering suite used by security researchers to analyze programs. A vulnerability in how it processes certain Apple Mach-O files allows a specially crafted file to crash the entire application. If a user attempts to import a malicious file, Ghidra will run out of memory and shut down, resulting in the loss of all unsaved work across all open projects.
Technical details
An uncontrolled resource consumption vulnerability (CWE-835/CWE-770) exists in ExportTrie.parseTrie() due to a lack of cycle detection during Breadth-First Search (BFS) traversal of Mach-O export tries. An attacker can craft a Mach-O binary with circular references (e.g., a child node pointing back to the root at offset 0), leading to infinite loop iterations, unbounded queue growth, and exponential string concatenation. This eventually triggers an OutOfMemoryError (OOM). Because OOM is an Error rather than an Exception, it is not caught by Ghidra's standard error handling, causing the entire JVM process to terminate. The vulnerability is exploitable via local file import in both GUI and headless modes. A fix is available in Ghidra version 12.1 which implements visited-offset tracking.
Affected products
- NSA Ghidra 10.2 to 12.0.4
Timeline
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE-2026-49495 published to NVD
- 2026-06-10: patched: Fixed in version 12.1