Executive brief
Ghidra is a popular open-source software reverse engineering suite used by security researchers to analyze malicious code. A vulnerability in its file-processing component allows a specially crafted file to crash the application immediately upon being opened. This can lead to a loss of unsaved work for analysts or disrupt automated security pipelines that process large volumes of files.
Technical details
An uncontrolled memory allocation vulnerability (CWE-789) exists in Ghidra's Mach-O binary parser within the MachHeader.java component. The parser unconditionally trusts the 'ncmds' (load command count) field from the Mach-O header and uses it to initialize an ArrayList. By providing a crafted binary with an arbitrarily large ncmds value, an attacker can force the JVM to attempt an oversized memory allocation that exceeds the available heap space, resulting in an OutOfMemoryError and application crash. This can be triggered during manual file import or via the headless analyzer. The issue is resolved in Ghidra version 12.1.1.
Affected products
- NSA Ghidra < 12.1.1
Timeline
- 2026-06-08: advisory: GitHub Security Advisory published by NSA developers
- 2026-06-10: disclosed: NVD and VulnCheck publication date