Skip to contentNationalsecurityagency Ghidra vulnerabilities
- nationalsecurityagency ghidraGhidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler ParserCVE-2026-116012Public exploit2.0 Low
- nationalsecurityagency ghidraGhidra before 12.2 Denial of Service via Compressed Extension ArchiveCVE-2026-1155036.8 Medium
- nationalsecurityagency ghidraGhidra before 12.2 Denial of Service via TAR and ZIP File System MountCVE-2026-1153986.8 Medium
- nationalsecurityagency ghidraGhidra before 12.2 Denial of Service via Extension Archive InstallCVE-2026-1153976.8 Medium
- nationalsecurityagency ghidraGhidra 10.3 before 12.2 Denial of Service via Compressed Theme ArchiveCVE-2026-1153966.8 Medium
- nationalsecurityagency ghidraGhidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()CVE-2026-1153956.8 Medium
- nationalsecurityagency ghidraGhidra through 12.2 Denial of Service via BinaryField Memory AllocationCVE-2026-1153946.8 Medium
- nationalsecurityagency ghidraGhidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header CountsCVE-2026-1136046.8 Medium
- nationalsecurityagency ghidraGhidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManagerCVE-2026-1005054.8 Medium
- nationalsecurityagency ghidraGhidra through 12.1.4 Stack-based Buffer Overflow via leftshift128CVE-2026-1005047.3 High
- nationalsecurityagency ghidraGhidra through 12.1.4 Heap Use-After-Free in DecompilerCVE-2026-1005034.8 Medium
- nationalsecurityagency ghidraGhidra before 12.1.4 Denial of Service via Unreleased Lock in OptionsDBCVE-2026-962736.8 Medium
- nationalsecurityagency ghidraGhidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdbCVE-2026-543896.7 Medium
- nationalsecurityagency ghidraGhidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim SearchCVE-2026-527588.7 High
- nationalsecurityagency ghidraGhidra < 12.1 - Heap-use-after-free in HighVariable::merge() during decompilationCVE-2026-527574.6 Medium
- nationalsecurityagency ghidraGhidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF ServerCVE-2026-527566.3 Medium
- nationalsecurityagency ghidraGhidra < 12.0.4 - Path Traversal via Zip Slip in Theme ImportCVE-2026-527558.4 High
- nationalsecurityagency ghidraGhidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModuleCVE-2026-527548.7 High
- nationalsecurityagency ghidraGhidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed SymbolCVE-2026-527536.7 Medium
- nationalsecurityagency ghidraGhidra < 12.0.2 - Path Traversal in Extension Installer via ZIP Entry NamesCVE-2026-527528.4 High
- nationalsecurityagency ghidraGhidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project ConnectionCVE-2026-527518.6 High
- nationalsecurityagency ghidraGhidra < 12.1- Command Injection via URL Annotation ClickCVE-2026-527507.3 High
- nationalsecurityagency ghidraGhidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped UsernameCVE-2026-494988.7 High
- nationalsecurityagency ghidraGhidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File ResolutionCVE-2026-494974.6 Medium
- nationalsecurityagency ghidraGhidra < 12.1 - Heap-Use-After-Free in SleighBuilder::generatePointerAdd via Vector ReallocationCVE-2026-494966.9 Medium
- nationalsecurityagency ghidraGhidra 10.2 < 12.1 - Denial of Service via Circular Reference in Mach-O Export Trie ParserCVE-2026-494956.7 Medium
- nationalsecurityagency ghidraGhidra < 11.2 - Use After Free in Sleigh Backend via Static Initialization OrderCVE-2024-583502.1 Low