What’s Vulnerable › Products

nationalsecurityagency ghidra vulnerabilities

35 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 29 published in the last 12 months.

Check whether your nationalsecurityagency ghidra version is affected

Latest nationalsecurityagency ghidra vulnerabilities

• CVE-2026-116012 — Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser (CVSS 3.6)
• CVE-2026-115395 — Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme() (CVSS 5.5)
• CVE-2026-115394 — Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation (CVSS 5.5)
• CVE-2026-115503 — Ghidra before 12.2 Denial of Service via Compressed Extension Archive (CVSS 5.5)
• CVE-2026-115398 — Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount (CVSS 5.5)
• CVE-2026-115397 — Ghidra before 12.2 Denial of Service via Extension Archive Install (CVSS 5.5)
• CVE-2026-115396 — Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive (CVSS 5.5)
• CVE-2026-113604 — Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts (CVSS 5.5)
• CVE-2026-100505 — Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager (CVSS 4.4)
• CVE-2026-100504 — Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128 (CVSS 7.0)
• CVE-2026-100503 — Ghidra through 12.1.4 Heap Use-After-Free in Decompiler (CVSS 5.5)
• CVE-2026-96273 — Ghidra before 12.1.4 Denial of Service via Unreleased Lock in OptionsDB (CVSS 5.5)
• CVE-2026-54389 — Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb (CVSS 5.5)
• CVE-2026-52759 — Ghidra < 12.1.1 - Denial of Service via Uncontrolled Memory Allocation in Mach-O Parser (CVSS 5.5)
• CVE-2026-52758 — Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search (CVSS 8.8)
• CVE-2026-52757 — Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() during decompilation (CVSS 4.4)
• CVE-2026-52756 — Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF Server (CVSS 6.5)
• CVE-2026-52755 — Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import (CVSS 7.8)
• CVE-2026-52754 — Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule (CVSS 8.8)
• CVE-2026-52753 — Ghidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol (CVSS 5.5)
• CVE-2026-52752 — Ghidra < 12.0.2 - Path Traversal in Extension Installer via ZIP Entry Names (CVSS 7.8)
• CVE-2026-52751 — Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection (CVSS 8.8)
• CVE-2026-52750 — Ghidra < 12.1- Command Injection via URL Annotation Click (CVSS 7.8)
• CVE-2026-49498 — Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username (CVSS 8.8)
• CVE-2026-49497 — Ghidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolution (CVSS 3.3)