EUVD-2026-63746Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
File parsed locally with required user interaction; no privileges needed to open a PDB; impact is solely Ghidra process crash with no confidentiality or integrity exposure.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters into an unbounded list, causing uncontrolled heap growth that triggers an OutOfMemoryError which bypasses exception handling and crashes the application.
AnalysisAI
Ghidra's PDB parser (all versions before 12.1.3) crashes when processing a crafted PDB file containing an oversized parameters section, enabling denial-of-service against security analysts. The AbstractPdb deserialization routine accumulates all parameters from the PDB stream into an unbounded heap list without size validation; the resulting OutOfMemoryError is a JVM Error subclass that bypasses standard exception handling, causing uncontrolled process termination. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open a crafted PDB file within Ghidra (UI:A per the CVSS 4.0 vector), making this a user-interaction-dependent local attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.7 with vector AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H reflects an accurate characterization of impact: local attack surface, no special conditions, but mandatory user interaction to open the file. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Ghidra 12.1.3 or later, available at https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.1.3_build (SHA-256: 93a5d11a9ad510622acaaf908c556a7b9b764d338e78a7567f3689bf5081fd54). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today