{"id":"CVE-2026-113604","title":"Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts","summary":"Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF …","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-789"],"vendor":"NationalSecurityAgency","product":"ghidra","affected":["ghidra >= 10.2 <= 12.1.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-20T16:19:40.402782Z"},"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T16:19:49.190Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113604","references":[{"url":"https://github.com/NationalSecurityAgency/ghidra/commit/6c50a66e8a939e2bcbaf0a6432ec5d53a41ceeb3"},{"url":"https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/elf/ElfHeader.java"},{"url":"https://www.vulncheck.com/advisories/ghidra-10.2-through-12.1.4-denial-of-service-via-elf-loader-extended-header-counts","label":"VulnCheck Advisory: Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T16:10:53.303Z","slug":"CVE-2026-113604","body":"## Overview\n\nGhidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec discovery at import or in headless analysis pipelines.\n\n## Affected\n\n- `ghidra >= 10.2 <= 12.1.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}