CVE-2026-54389: Allocation of Resources Without Limits or Throttling in NationalSecurityAgency ghidra
Description
Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters into an unbounded list, causing uncontrolled heap growth that triggers an OutOfMemoryError which bypasses exception handling and crashes the application.
CVSS v4.0
Score 6.7medium
Affected software
NationalSecurityAgency
ghidra
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-54389 is an uncontrolled resource consumption vulnerability affecting Ghidra before version 12.1.3. The issue exists in the PDB parser component, specifically in the AbstractPdb deserialization routine, which reads all remaining parameters from a crafted PDB file into an unbounded list. This leads to excessive heap memory allocation, triggering an OutOfMemoryError that bypasses exception handling and crashes the application process.
Potential Impact
Successful exploitation results in denial of service by crashing the Ghidra process. This disrupts analysis workflows but does not provide code execution or data corruption based on the available information.
Mitigation Recommendations
Upgrade Ghidra to version 12.1.3 or later where this vulnerability is fixed. No other mitigation or workaround is indicated in the provided data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-12T20:20:02.950Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a877e39acd9273b493410b0
Added to database: 08/20/2026, 22:22:49 UTC
Last enriched: 10/02/2026, 15:50:18 UTC
Last updated: 10/05/2026, 06:48:17 UTC
Views: 85
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.