Executive brief
Ghidra is a reverse-engineering toolkit used by security researchers and analysts to examine binary files and malware. A flaw in the PDB (program database) file parser allows an attacker to crash the Ghidra application by supplying a specially crafted PDB file, disrupting analysis workflows and potentially halting automated malware triage pipelines.
Technical details
The vulnerability is an uncontrolled resource consumption issue (CWE-400) in the AbstractPdb.deserializeParameters() method. The PDB parser reads all remaining 32-bit integers from a stream into an unbounded ArrayList without validating the count, causing heap exhaustion when processing a malicious PDB with an oversized parameters section. A 40 MB crafted stream triggers ~10 million iterations, each allocating a heap Integer object, resulting in an OutOfMemoryError that unconditionally terminates the JVM process. The bug bypasses normal exception handling because OutOfMemoryError is a java.lang.Error, not a checked exception. Exploitation requires user interaction (opening a PDB file) but no privileges; attack vector is local. The vulnerability is patched in version 12.1.3.
Affected products
- National Security Agency Ghidra before 12.1.3
Timeline
- 2026-08-19: disclosed
- 2026-08-18: patched: Version 12.1.3 released