Medium 6.8

Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read(...

CVE-2026-115394 First seen on SecPulse 04:14

Affected packages

Ecosystem	Package	Affected	Fixed
NationalSecurityAgency	ghidra	≤ 12.2	—

Original description The description as published by the source.

Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit length field. Attackers can persuade users to import a crafted GZF packed database file, triggering an OutOfMemoryError in PackedDatabase.open() that aborts the import and denies service.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.5; CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4: Medium 6.8; CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Published: Oct 23, 2026
First seen on SecPulse: 04:14
GHSA: GHSA-cj2j-2w64-7q9c
CWE: CWE-789

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Denial of Service

All

Cwe 789 Nationalsecurityagency Ghidra

Detection sources

NIST National Vulnerability Database04:17
GitHub Security Advisories (Global)06:32
CVE.org (CVE Program・cvelistV5)04:14