CVE-2026-96273 in Ghidra
Summary
by MITRE • 09/23/2026
Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and prevents resource cleanup or graceful shutdown.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Ghidra versions prior to 12.1.4 stems from an insufficient input validation mechanism within the OptionsDB.createUnregisteredOption() method. Specifically, the software fails to properly validate the TYPE_COL byte before attempting to utilize it as an index for array access or data structure manipulation. This lack of boundary checking allows a crafted value that falls outside the expected range to be processed without triggering an exception handler designed to manage such errors gracefully. Instead of failing safely, the application encounters an ArrayIndexOutOfBoundsException during runtime execution when processing this malformed input.
From a technical perspective, this flaw represents a classic case of improper validation leading to unhandled exceptions and subsequent resource leaks. When the malicious program database file is imported into Ghidra, the parsing logic attempts to access memory locations based on the invalid TYPE_COL value. Because the exception occurs within a critical section responsible for managing domain objects and configuration states, the normal cleanup routines are bypassed or interrupted. Consequently, internal locks associated with these domain objects remain held indefinitely, preventing subsequent operations from accessing them effectively.
The operational impact of this vulnerability is significant in terms of availability and system stability. An attacker who can persuade a user to import a specially crafted program database file can cause the Ghidra application to stall or become unresponsive. This denial-of-service condition persists because the locked domain objects prevent proper resource cleanup and inhibit graceful shutdown procedures. Users are forced to terminate the process forcefully, which may lead to data corruption in open projects or loss of unsaved work. The persistence of these locks means that even after restarting the application, residual state issues might continue to affect functionality until specific cache files are manually cleared or configuration states are reset.
This vulnerability aligns with CWE-20: Improper Input Validation and CWE-754: Improper Check for Unusual or Exceptional Conditions. The failure to validate the TYPE_COL byte against expected bounds is a direct violation of secure coding principles that mandate rigorous checking of all external inputs before processing. Furthermore, in the context of the MITRE ATT&CK framework, this behavior can be categorized under T1499: Endpoint Denial of Service, as it results in the disruption of service for the local analysis environment without requiring remote code execution or privilege escalation.
Mitigation strategies primarily involve upgrading to Ghidra version 12.1.4 or later, where the input validation logic has been corrected to ensure that all byte values are checked against permissible ranges before being used as indices. For environments where immediate patching is not feasible, administrators should enforce strict policies regarding the import of external database files and program binaries from untrusted sources. Implementing sandboxed execution environments for analyzing suspicious artifacts can also mitigate the risk by isolating potential crashes from the host system's critical resources. Additionally, monitoring application logs for repeated ArrayIndexOutOfBoundsException errors related to OptionsDB may help in detecting attempted exploitation activities early.