Nationalsecurityagency Ghidra
27 CVEs affecting Nationalsecurityagency Ghidra. Latest disclosed: 2026-10-24. Critical: 0, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-52758 | High | 8.8 | 2026-06-10 | Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping… |
CVE-2026-52754 | High | 8.8 | 2026-06-10 | Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows any user with a valid CA-signed certif… |
CVE-2026-52751 | High | 8.8 | 2026-06-10 | Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code e… |
CVE-2026-49498 | High | 8.8 | 2026-06-10 | Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in… |
CVE-2026-52755 | High | 7.8 | 2026-06-10 | Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme… |
CVE-2026-52752 | High | 7.8 | 2026-06-10 | Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate ZIP entry names during extraction. Attackers can… |
CVE-2026-52750 | High | 7.8 | 2026-06-10 | Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Atta… |
CVE-2026-100504 | High | 7.0 | 2026-09-26 | Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift… |
CVE-2026-49496 | Medium | 6.1 | 2026-06-10 | Ghidra before 12.1 contains a heap-use-after-free vulnerability in SleighBuilder::generatePointerAdd caused by iterator invalidation when PcodeCacher::allocate… |
CVE-2026-115503 | Medium | 5.5 | 2026-10-22 | Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to… |
CVE-2026-115398 | Medium | 5.5 | 2026-10-22 | Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store un… |
CVE-2026-115397 | Medium | 5.5 | 2026-10-22 | Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP… |
CVE-2026-115396 | Medium | 5.5 | 2026-10-22 | Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed… |
CVE-2026-115395 | Medium | 5.5 | 2026-10-22 | Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to… |
CVE-2026-115394 | Medium | 5.5 | 2026-10-22 | Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecke… |
CVE-2026-113604 | Medium | 5.5 | 2026-10-20 | Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended s… |
CVE-2026-96273 | Medium | 5.5 | 2026-09-23 | Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain… |
CVE-2026-54389 | Medium | 5.5 | 2026-08-20 | Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by sup… |
CVE-2026-52753 | Medium | 5.5 | 2026-06-10 | Ghidra before 12.0.3 contains an out-of-memory vulnerability in the rust_demangle function that allocates unbounded output buffers without size limits. Attacke… |
CVE-2026-49495 | Medium | 5.5 | 2026-06-10 | Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() that lacks cycle detection when traversing Mach-O… |