Product by Nationalsecurityagency
Ghidra
27 known vulnerabilities in Ghidra (Nationalsecurityagency), 0 of them actively exploited (CISA KEV).
Key figures
27
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-52751 | Nationalsecurityagency Ghidra: Deserialization of Untrusted Data | 8.8 | |
| High | CVE-2026-52750 | Ghidra < 12.1- Command Injection via URL Annotation Click | 7.8 | |
| High | CVE-2026-52758 | Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search | 8.8 | |
| High | CVE-2026-49498 | Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username | 8.8 | |
| High | CVE-2026-52754 | Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule | 8.8 | |
| Medium | CVE-2026-115398 | Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount | 5.5 | |
| Medium | CVE-2026-115394 | Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation | 5.5 | |
| Medium | CVE-2026-113604 | Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts | 5.5 | |
| Medium | CVE-2026-115397 | Ghidra before 12.2 Denial of Service via Extension Archive Install | 5.5 | |
| Medium | CVE-2026-115396 | Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive | 5.5 | |
| Medium | CVE-2026-115503 | Ghidra before 12.2 Denial of Service via Compressed Extension Archive | 5.5 | |
| Medium | CVE-2026-115395 | Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme() | 5.5 | |
| High | CVE-2026-100504 | Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128 | 7.0 | |
| Medium | CVE-2026-52756 | Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF Server | 6.5 | |
| High | CVE-2026-52755 | Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import | 7.8 | |
| High | CVE-2026-52752 | Ghidra < 12.0.2 - Path Traversal in Extension Installer via ZIP Entry Names | 7.8 | |
| Medium | CVE-2026-96273 | Ghidra before 12.1.4 Denial of Service via Unreleased Lock in OptionsDB | 5.5 | |
| Medium | CVE-2026-54389 | Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb | 5.5 | |
| Medium | CVE-2026-49496 | Ghidra < 12.1 - Heap-Use-After-Free in SleighBuilder::generatePointerAdd via Vector Reallocation | 6.1 | |
| Medium | CVE-2026-52753 | Ghidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol | 5.5 | |
| Medium | CVE-2026-49495 | Ghidra 10.2 < 12.1 - Denial of Service via Circular Reference in Mach-O Export Trie Parser | 5.5 | |
| Medium | CVE-2026-100505 | Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager | 4.4 | |
| Medium | CVE-2026-100503 | Ghidra through 12.1.4 Heap Use-After-Free in Decompiler | 3.3 | |
| Low | CVE-2026-116012 | Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser | 3.6 | |
| Medium | CVE-2026-49497 | Ghidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolution | 3.3 |