{"id":"CVE-2026-96273","title":"Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked","summary":"Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database f…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cwe":["CWE-460"],"vendor":"NationalSecurityAgency","product":"ghidra","affected":["ghidra < 12.1.4"],"published":"2026-09-23","updated":"2026-09-23","sourceUpdated":"2026-09-23T14:17:10.610","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96273","references":[{"url":"https://github.com/NationalSecurityAgency/ghidra","label":"disclosure@vulncheck.com"},{"url":"https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.3_build/Ghidra/Framework/Project/src/main/java/ghidra/framework/data/OptionsDB.java#L358-L366","label":"disclosure@vulncheck.com"},{"url":"https://github.com/NationalSecurityAgency/ghidra/commit/594da048431aab082a9da7c4a965874d07d33310","label":"disclosure@vulncheck.com"},{"url":"https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.1.4_build","label":"disclosure@vulncheck.com"},{"url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-4w7g-wmg8-fgv5","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/ghidra-before-12.1.4-denial-of-service-via-crafted-database","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-23T13:46:33.318445Z"},"ingestedAt":"2026-09-23T01:14:44.486Z","slug":"CVE-2026-96273","body":"## Overview\n\nGhidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and prevents resource cleanup or graceful shutdown.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}