CVE-2026-96273
Received Received - Intake

Ghidra ArrayIndexOutOfBoundsException in OptionsDB.createUnregisteredOption

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulnCheck

Description
Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and prevents resource cleanup or graceful shutdown.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96273
EUVD
EUVD-2026-84992

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
national_security_agency ghidra to 12.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-460 The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Ghidra before version 12.1.4 involves improper validation of the TYPE_COL byte in the OptionsDB.createUnregisteredOption() function. When a crafted program database file is imported, it triggers an ArrayIndexOutOfBoundsException that permanently locks domain objects. The application stalls and cannot clean up resources or shut down gracefully.

Detection Guidance

Detecting this vulnerability requires checking the Ghidra version in use. Run 'ghidra --version' or check the installed package version. If the version is below 12.1.4, the system is vulnerable. Additionally, monitor for stalled Ghidra processes or locked domain objects during binary analysis tasks.

Impact Analysis

This vulnerability can cause denial of service by stalling Ghidra instances, preventing resource cleanup and graceful shutdown. Automated binary analysis pipelines may be blocked, as a single malicious file can lock domain objects permanently. Users may experience application hangs or crashes when processing affected files.

Compliance Impact

This vulnerability primarily causes a denial of service by locking domain objects and preventing resource cleanup, which could disrupt automated analysis workflows. It does not directly expose or leak sensitive data, but prolonged system unavailability may impact compliance with availability requirements in standards like GDPR (Article 32) or HIPAA (Security Rule). Organizations using vulnerable Ghidra versions may face operational disruptions that could lead to non-compliance if critical systems are affected.

Mitigation Strategies

Upgrade Ghidra to version 12.1.4 or later immediately. Download the latest release from the official Ghidra GitHub repository. Ensure all automated analysis pipelines are restarted after the update to clear any existing locks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96273. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart