CVE-2026-54389 in Ghidra
Summary
by MITRE • 08/21/2026
Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters into an unbounded list, causing uncontrolled heap growth that triggers an OutOfMemoryError which bypasses exception handling and crashes the application.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in Ghidra versions prior to 12.1.3 represents a critical flaw within its Portable Executable Debug Information Database parser, specifically affecting how the tool handles serialized data structures during reverse engineering tasks. This uncontrolled resource consumption issue stems from an implementation error in the AbstractPdb deserialization routine, which is responsible for parsing PDB files that contain debug symbols and metadata essential for understanding compiled binaries. When Ghidra processes a maliciously crafted PDB file containing an oversized parameters section, the parser fails to enforce any limits on the size of data structures it allocates in memory. Instead of validating the length or size constraints before processing, the routine proceeds to read all remaining parameters into an unbounded list structure without checking for potential overflow conditions or resource exhaustion thresholds.
This lack of input validation leads directly to excessive heap growth as the application attempts to accommodate the artificially inflated data payload provided by the attacker. The Java Virtual Machine environment in which Ghidra operates eventually encounters a memory limit that cannot be satisfied, resulting in an OutOfMemoryError exception. Crucially, this specific error condition bypasses standard exception handling mechanisms within the parser logic due to the severity of the resource exhaustion state. Consequently, rather than gracefully degrading or returning a controlled error message to the user interface, the application terminates abruptly and unexpectedly. This behavior effectively allows any individual with access to Ghidra to cause a denial-of-service condition against the tool itself by simply opening a specially constructed PDB file, thereby disrupting analysis workflows and potentially causing loss of unsaved work for reverse engineers relying on the software.
From a classification perspective, this vulnerability aligns closely with CWE-400 Uncontrolled Resource Consumption, as the root cause is the failure to restrict the amount of system resources consumed during input processing. It also relates to CWE-789 Memory Allocation with Excessive Size Values, highlighting the specific mechanism by which heap space is exhausted through oversized inputs. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw can be leveraged in the context of T1496 Resource Hijacking or more specifically within software exploitation scenarios where stability and availability are targeted rather than confidentiality or integrity. While Ghidra is primarily a defensive tool used for malware analysis and vulnerability research, compromising its availability undermines trust in automated parsing tools and could distract analysts during critical investigations if integrated into larger pipelines that automatically process binary artifacts.
Mitigation strategies must focus on implementing strict input validation and resource limits within the PDB parser module. Developers should enforce maximum size constraints on all parsed sections before allocating memory for data structures, ensuring that any parameter exceeding predefined thresholds is rejected early in the parsing lifecycle rather than processed to completion. Additionally, integrating circuit-breaker patterns or timeout mechanisms can prevent long-running operations from consuming excessive resources even if validation fails. For users operating with older versions of Ghidra, immediate upgrading to version 12.1.3 or later is required as this issue has been addressed in the patched release through corrected deserialization logic that properly bounds list allocations and handles memory constraints gracefully without crashing the host process.