CVE-2026-49495
MEDIUMGhidra 10.2 < 12.1 - Denial of Service via Circular Reference in Mach-O Export Trie Parser
Title source: cnaDescription
Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() that lacks cycle detection when traversing Mach-O binary export tries. A crafted Mach-O binary with circular references in the export trie causes unbounded queue growth and exponential string concatenation, triggering OutOfMemoryError that crashes the entire JVM and loses all unsaved work.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-wm33-9f68-3vjg)
https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-wm33-9f68-3vjg
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/ghidra-denial-of-service-via-circular-reference-in-mach-o-export-trie-parser
Scores
CVSS v3
5.5
EPSS
0.0011
EPSS Percentile
1.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-835
Status
published
Products (3)
nationalsecurityagency/ghidra
10.2 - 12.1
nationalsecurityagency/ghidra
12.1
nsa/ghidra
10.2 - 12.1
Published
Jun 10, 2026
Tracked Since
Jun 10, 2026