CVE-2026-49495

Ghidra 10.2 < 12.1 - Denial of Service via Circular Reference in Mach-O Export Trie Parser

State: Published
Severity: 6.7 Medium
Published: Jun 10, 2026
Updated: Jul 14, 2026
Reserved: May 31, 2026

Description

Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() that lacks cycle detection when traversing Mach-O binary export tries. A crafted Mach-O binary with circular references in the export trie causes unbounded queue growth and exponential string concatenation, triggering OutOfMemoryError that crashes the entire JVM and loses all unsaved work.

Scores

CVSS	Score	Vector	Source
4.0	6.7 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	VulnCheck

Weaknesses

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

Affected Products

Product	Versions
ghidranationalsecurityagency	10.2 to before 12.1Affected 12.1Not affected

References

GitHub Security Advisory (GHSA-wm33-9f68-3vjg)vendor-advisory
https://www.vulncheck.com/advisories/ghidra-denial-of-service-via-circular-reference-in-mach-o-export-trie-parserthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.