EUVD-2026-36004Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() that lacks cycle detection when traversing Mach-O binary export tries. A crafted Mach-O binary with circular references in the export trie causes unbounded queue growth and exponential string concatenation, triggering OutOfMemoryError that crashes the entire JVM and loses all unsaved work.
AnalysisAI
Uncontrolled resource consumption in Ghidra's Mach-O binary parser (versions 10.2 through pre-12.1) allows a crafted binary to crash the entire JVM and destroy all unsaved analyst work. The ExportTrie.parseTrie() method lacks cycle detection when walking export trie structures, so a malicious Mach-O binary embedding circular trie references triggers unbounded queue growth and exponential string concatenation until an OutOfMemoryError terminates the JVM process. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the risk is materially elevated in adversarial research contexts where analysts routinely open untrusted binaries - exactly the workflow Ghidra is designed for.
Technical ContextAI
Ghidra is the NSA-released Java-based reverse engineering framework (CPE: cpe:2.3:a:nationalsecurityagency:ghidra:*:*:*:*:*:*:*:*). The Mach-O binary format used by Apple platforms includes an export trie - a compressed trie data structure encoding exported symbol names and addresses. The parser in ExportTrie.parseTrie() traverses this structure using a queue or recursive approach. CWE-835 (Loop with Unreachable Exit Condition) is the root cause: when the trie contains a node that back-references an ancestor, the traversal never terminates. The JVM heap fills from two compounding effects: the work queue grows without bound as new nodes are enqueued faster than they are dequeued, and string concatenation of trie path prefixes grows exponentially at each circular node, consuming heap at an accelerating rate until the JVM throws OutOfMemoryError, which in Ghidra's single-process architecture terminates the entire application.
RemediationAI
The primary fix is upgrading to Ghidra 12.1 or later, which introduces cycle detection in the ExportTrie.parseTrie() method. The vendor advisory is available at https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-wm33-9f68-3vjg and the VulnCheck write-up at https://www.vulncheck.com/advisories/ghidra-denial-of-service-via-circular-reference-in-mach-o-export-trie-parser. The exact patched release version is stated as 12.1 in the description but should be independently confirmed against the GitHub release page before deployment. If immediate upgrade is not possible, the most targeted workaround is to avoid opening Mach-O binaries from untrusted sources in unpatched Ghidra instances; analysts should instead use an isolated VM or sandbox environment where a JVM crash has no impact on broader work. Saving work frequently before opening any untrusted binary reduces the data-loss component of the impact. There is no known configuration switch to disable export trie parsing selectively, so functional workarounds short of version upgrade are limited.
Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files featu
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a pro
NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working directory. Ra
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive)
Command injection in NSA Ghidra (versions before 12.0.3) executes arbitrary commands when analysts click on maliciously
SQL injection in Ghidra's BSim binary-similarity component (versions before 12.1) allows authenticated remote attackers
Authentication bypass in NSA Ghidra versions prior to 12.1 allows any holder of a valid CA-signed certificate to imperso
SQL injection in Ghidra's PostgreSQL collaboration backend (versions 11.0 through pre-12.1) allows authenticated users t
Remote code execution in NSA Ghidra before version 12.1 allows attackers to execute arbitrary commands when a user opens
Command injection in Ghidra versions before 12.1 on Windows allows attackers to execute arbitrary OS commands under the
Arbitrary file write in NSA's Ghidra reverse-engineering framework before version 12.0.4 allows attackers to escape the
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today