CVE-2026-115394 Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation

What is CVE-2026-115394?

CVE-2026-115394 is a medium-severity vulnerability in NationalSecurityAgency ghidra, published on 22 Oct 2026.

Official description

Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit length field. Attackers can persuade users to import a crafted GZF packed database file, triggering an OutOfMemoryError in PackedDatabase.open() that aborts the import and denies service.

Weakness: CWE-789

Which versions are affected by CVE-2026-115394?

It affects 1 product.

Products include Nsa Ghidra.

How do I fix CVE-2026-115394?

No fix has been published for CVE-2026-115394 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-115394 being exploited?

There is no known exploitation of CVE-2026-115394 in the wild and no public exploit code.

Other vulnerabilities in NationalSecurityAgency ghidra

• CVE-2023-22671 Command injection in n/a Critical 9.8
• CVE-2019-16941 XML external entity in n/a Critical 9.8
• CVE-2019-13625 XML external entity in n/a Critical 9.1
• CVE-2026-4946 NSA Ghidra Auto-Analysis Annotation Command Execution High 8.8
• CVE-2026-49498 Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-cj2j-2w64-7q9c, GHSA-q538-hhhf-5jxp.