Threat database

Ghidra versions prior to 12.2 contain a numeric truncation vulnerability in the PackedDecode::skipAttribute and skipAttributeRemaining functions. This flaw arises from storing 64-bit string lengths in 32-bit variables, which can be triggered by a crafted packed stream such as a malicious .sla file. Exploitation may allow injection of attributes into the decompiler's input or cause the decompiler process to crash. The vulnerability has a low CVSS score and does not indicate critical impact or widespread exploitation.

Ghidra versions before 12.2 have a vulnerability in the ExtensionUtils.unzipToInstallationFolder() function that improperly handles highly compressed data. This flaw allows attackers to craft zip bomb extension archives that expand without size limits, potentially exhausting disk space. This can cause failures in subsequent writes by Ghidra and other applications. The vulnerability requires user interaction to install a malicious extension archive.

Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.

Ghidra versions before 12.2 have a vulnerability in the ExtensionUtils.unzipToInstallationFolder() function where ZIP entries are extracted without limiting the number of files. This can lead to exhaustion of filesystem inodes if a user installs a maliciously crafted extension archive containing many files, causing failures in project writes and other processes.

Ghidra versions 10.3 up to but not including 12.2 contain a vulnerability in the ThemeReader.processIconFile() function where highly compressed data is improperly handled. This flaw allows crafted theme ZIP files with icon entries that decompress to very large sizes, potentially filling the host filesystem and causing subsequent write operations to fail. The vulnerability requires user interaction to import the malicious theme file. The CVSS 4.0 base score is 6.8, indicating a medium severity level.

Ghidra versions 10.3 up to but not including 12.2 have a vulnerability in the ThemeReader.readZipTheme() function where importing a crafted theme ZIP archive with many small files can exhaust disk inodes and space, causing a denial of service. This occurs due to resource allocation without limits or throttling during theme extraction. The vulnerability requires user interaction to import the malicious theme archive.

Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit length field. Attackers can persuade users to import a crafted GZF packed database file, triggering an OutOfMemoryError in PackedDatabase.open() that aborts the import and denies service.

Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec discovery at import or in headless analysis pipelines.

Ghidra versions 9.2 through 12.1.4 have a heap out-of-bounds read vulnerability in the StringManager::getCodepoint function when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters. This occurs because the function does not validate the remaining buffer length, allowing crafted binaries with specially formed strings to trigger out-of-bounds reads. Exploitation can cause crashes or leak adjacent heap memory into the decompiled output.

Ghidra versions up to 12.1.4 have a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function. This occurs when processing negative shift amounts from p-code, allowing crafted binaries to trigger memory corruption during decompilation. The vulnerability has a high severity rating with a CVSS score of 7.3.

Ghidra versions up to 12.1.4 have a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function. This flaw is caused by stale INDIRECT effect-op references. An attacker can craft a malicious x86-64 binary that triggers a crash in the decompile helper process, resulting in denial of service for analysts and automated pipelines.

Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and prevents resource cleanup or graceful shutdown.

Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters into an unbounded list, causing uncontrolled heap growth that triggers an OutOfMemoryError which bypasses exception handling and crashes the application.

Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parameterization. Remote attackers can inject arbitrary SQL via the BSim network query protocol to read, modify, or delete data in the PostgreSQL database.

Ghidra before 12.1 contains a heap-use-after-free vulnerability in the decompiler's HighVariable::merge() function during the variable merging pass. Attackers can trigger this vulnerability by crafting a binary that causes stale pointers in the HighIntersectTest::highedgemap cache to be dereferenced, reading and writing the flags field of freed heap memory when a user opens the binary in Ghidra's decompiler view.

Ghidra before 12.2 contains an unauthenticated path traversal vulnerability in the IsfServer that accepts TCP connections and passes client-supplied namespace strings directly to filesystem operations without validation. Remote attackers can connect to port 54321 and send crafted protobuf messages with traversal sequences to enumerate filesystem paths and probe arbitrary files.

Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensitive files like .bashrc or .ssh/authorized_keys.

Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows any user with a valid CA-signed certificate to impersonate other users by presenting their public certificate with a null signature. Attackers can escalate privileges, modify repository access controls, exfiltrate shared reverse engineering databases, and permanently compromise server integrity.

Ghidra before 12.0.3 contains an out-of-memory vulnerability in the rust_demangle function that allocates unbounded output buffers without size limits. Attackers can craft malicious Rust symbol names in binaries to trigger exponential memory allocation, causing process crashes during binary analysis.

Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate ZIP entry names during extraction. Attackers can craft malicious extensions with traversal sequences like ../ in filenames to write arbitrary files outside the intended directory, enabling code execution.