CVE-2026-54389

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54389

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54389.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54389

Aliases

GHSA-f75p-8cqj-9v3g

Published

2026-08-20T22:02:30Z

Modified

2026-08-27T11:30:40Z

Severity

6.7 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb

Details

Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters into an unbounded list, causing uncontrolled heap growth that triggers an OutOfMemoryError which bypasses exception handling and crashes the application.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54389.json"
}

References

Affected packages

Git / github.com/nationalsecurityagency/ghidra

Affected ranges

Type

GIT

Repo

https://github.com/nationalsecurityagency/ghidra

Events

Introduced

Fixed

8b4c91d4d5bd1549622bfbade0df199585b98365

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "12.1.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

Ghidra_10.*

Ghidra_10.3_build

Ghidra_12.*

Ghidra_12.1.1_build

Ghidra_12.1.2_build

Ghidra_12.1_build

Ghidra_9.*

Ghidra_9.0.1_build

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54389.json"