CVE-2026-54389

Received Received - Intake

Uncontrolled Resource Consumption in Ghidra PDB Parser

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description

Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters into an unbounded list, causing uncontrolled heap growth that triggers an OutOfMemoryError which bypasses exception handling and crashes the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-54389

Affected Vendors & Products

Vendor	Product	Version / Range
ghidra	ghidra	to 12.1.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

Ghidra before version 12.1.3 has a flaw in its PDB parser where it does not properly limit memory usage. Attackers can exploit this by providing a specially crafted PDB file with an oversized parameters section. The software attempts to read all parameters into an unbounded list, causing excessive heap memory consumption. This leads to an OutOfMemoryError that crashes the application without proper exception handling.

Detection Guidance

This vulnerability can be detected by monitoring Ghidra processes for crashes when processing PDB files. Check for OutOfMemoryError logs in Ghidra's application logs or system logs when a PDB file is processed. No specific commands are provided in the context.

Impact Analysis

If you use Ghidra for reverse engineering or software analysis, an attacker could send you a malicious PDB file to crash your Ghidra instance. This disrupts your workflow and may cause loss of unsaved work. The crash occurs without requiring user interaction beyond opening the file.

Compliance Impact

This vulnerability causes uncontrolled resource consumption leading to application crashes, which may disrupt data processing or availability. For compliance standards like GDPR or HIPAA, such disruptions could impact data integrity, availability, or security obligations, potentially leading to violations if critical systems are affected.

Mitigation Strategies

Upgrade Ghidra to version 12.1.3 or later to address the uncontrolled resource consumption vulnerability in the PDB parser. Avoid processing untrusted PDB files until the update is applied.

Hi! I’m here to help you understand CVE-2026-54389. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70