Live › vulnerability › CVE-2026-113604
Go to dashboardGhidra's ELF loader trusts unvalidated extended section and program header counts when allocating arrays. A crafted 128-byte ELF file makes the import or headless analysis crash with an OutOfMemoryError, a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Ghidra 10.2 through 12.1.4 and import ELF binaries from sources they do not control, such as malware samples, firmware or third-party uploads, are exposed. Teams that only analyze their own trusted builds in a closed environment are at much lower risk. The sources do not say whether the flaw is reachable through any other file format.
No product ranges from the sources yet.
application.properties file or the release name on the install path.analyzeHeadless) that import binaries from untrusted sources.12.1.4; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec discovery at import or in headless analysis pipelines.
This page as .md · .json · in your agent: get_signal("CVE-2026-113604")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.