Vulnerability Description
Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() that lacks cycle detection when traversing Mach-O binary export tries. A crafted Mach-O binary with circular references in the export trie causes unbounded queue growth and exponential string concatenation, triggering OutOfMemoryError that crashes the entire JVM and loses all unsaved work.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nsa | Ghidra | >= 10.2, < 12.1 |
Related Weaknesses (CWE)
References
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-wm33-9ExploitMitigationVendor Advisory
- https://www.vulncheck.com/advisories/ghidra-denial-of-service-via-circular-referThird Party Advisory
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-wm33-9ExploitMitigationVendor Advisory
FAQ
What is CVE-2026-49495?
CVE-2026-49495 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() that lacks cycle detection when traversing Mach-O binary export tries. A crafted Mach-O bi...
How severe is CVE-2026-49495?
CVE-2026-49495 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-49495?
Check the references section above for vendor advisories and patch information. Affected products include: Nsa Ghidra.