CVE-2024-58350 Ghidra < 11.2 - Use After Free in Sleigh Backend via Static Initialization Order

What is CVE-2024-58350?

CVE-2024-58350 is a low-severity use after free vulnerability in nationalsecurityagency ghidra, published on 10 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Ghidra before 11.2 contains a use after free vulnerability in the Sleigh backend caused by undefined static initialization order of the SleighArchitecture::translators and XmlArchitectureCapability singletons. Attackers can trigger an infinite loop or denial of service during shutdown by exploiting the unsafe destruction order that causes iteration over deallocated memory.

Weakness: CWE-758

Which versions are affected by CVE-2024-58350?

It affects 1 product.

Products include Nsa Ghidra.

How do I fix CVE-2024-58350?

No fix has been published for CVE-2024-58350 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2024-58350 being exploited?

There is no known exploitation of CVE-2024-58350 in the wild and no public exploit code.

Other vulnerabilities in nationalsecurityagency ghidra

• CVE-2023-22671 Command injection in n/a Critical 9.8
• CVE-2019-16941 XML external entity in n/a Critical 9.8
• CVE-2019-13625 XML external entity in n/a Critical 9.1
• CVE-2026-4946 NSA Ghidra Auto-Analysis Annotation Command Execution High 8.8
• CVE-2026-49498 Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4g43-2f29-xvp4.