Executive brief
Ghidra is a reverse-engineering framework used by security analysts to examine and understand software. A vulnerability in how Ghidra processes database files allows an attacker to craft a malicious program database that, when opened, crashes the application and permanently locks files, preventing the analyst from working with those files until the application is forcibly restarted.
Technical details
The OptionsDB.createUnregisteredOption() method fails to validate the TYPE_COL byte, allowing an array index out of bounds exception when processing a malicious database file. The exception leaves domain objects in a locked state, stalling the application and preventing graceful resource cleanup. This is triggered via a maliciously crafted program database file opened through the normal import mechanism.
Affected products
- National Security Agency Ghidra before 12.1.4
Timeline
- 2026-09-23: disclosed