CVE-2026-49495

5.5 MEDIUM

Published: June 10, 2026 Modified: June 11, 2026

Description

Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() that lacks cycle detection when traversing Mach-O binary export tries. A crafted Mach-O binary with circular references in the export trie causes unbounded queue growth and exponential string concatenation, triggering OutOfMemoryError that crashes the entire JVM and loses all unsaved work.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-wm33-9f68-3vjg

Source: disclosure@vulncheck.com

Exploit Vendor Advisory Mitigation

https://www.vulncheck.com/advisories/ghidra-denial-of-service-via-circular-reference-in-mach-o-export-trie-parser

Source: disclosure@vulncheck.com

Third Party Advisory

https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-wm33-9f68-3vjg

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit Vendor Advisory Mitigation

3 reference(s) from NVD

Quick Stats

CVSS v3 Score

5.5 / 10.0

EPSS (Exploit Probability)

0.0%

2th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-835

Affected Vendors

nsa

Related CVEs

CVE-2026-50100 7.8

CVE-2026-44188 5.3

CVE-2026-11860 N/A

CVE-2026-9278 N/A

CVE-2026-8935 N/A