CVE-2026-113604
Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in Ghidra via ELF Header Parsing

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec discovery at import or in headless analysis pipelines.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-113604
EUVD
EUVD-2026-105082

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
NationalSecurityAgency ghidra 10.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service vulnerability in Ghidra versions 10.2 through 12.1.4. It occurs in the ELF loader's ElfHeader class where arrays are allocated based on unvalidated extended section and program header counts. Attackers can craft a 128-byte ELF file that causes an OutOfMemoryError during file loading or analysis.

Detection Guidance

Detecting this vulnerability requires analyzing ELF files processed by Ghidra. Monitor for OutOfMemoryError exceptions during Ghidra's ELF loading process. Check Ghidra logs for crashes when processing 128-byte ELF files with high extended header counts. Use Ghidra's headless mode with crafted test files to observe abnormal memory consumption.

Impact Analysis

This vulnerability allows attackers to crash Ghidra instances by supplying a specially crafted ELF file. This could disrupt reverse engineering tasks, automated analysis pipelines, or any Ghidra-based workflows that process untrusted files.

Compliance Impact

This vulnerability primarily causes denial of service through excessive memory consumption during ELF file parsing, which does not directly impact data privacy or confidentiality required by standards like GDPR or HIPAA. However, if the denial of service disrupts critical systems handling sensitive data, it could indirectly affect compliance by impairing access to protected information.

Mitigation Strategies

Update Ghidra to a version beyond 12.1.4 where the ELF header validation fixes are implemented. Apply the security patches referenced in the Ghidra commit 6c50a66e8a939e2bcbaf0a6432ec5d53a41ceeb3. Avoid processing untrusted ELF files in Ghidra until patched. Implement input validation for ELF files before analysis.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113604. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...