Ghidra releases before version 11.2 suffer from a use‑after‑free flaw in the Sleigh backend. The vulnerability arises from an undefined static initialization order between the SleighArchitecture::translators and XmlArchitectureCapability singletons. When the application shuts down, this unsafe destruction order causes an iteration over deallocated memory, which can trigger an infinite loop or a crash. The flaw is a classic use‑after‑free weakness (CWE‑758) and results in availability loss for the affected system.

The National Security Agency’s Ghidra reverse‑engineering suite, specifically any release earlier than 11.2, is impacted. The flaw is present in all platforms supported by Ghidra, as the unsafe static initialization is part of the core C++ code and not platform‑specific.

The CVSS score of 2.1 indicates a low severity level, and the exploitation probability (EPSS) is not available. The vulnerability is not listed in CISA’s KEV catalog. The memory corruption can only be triggered during the shutdown phase of the application, implying that an attacker must have the ability to run and terminate Ghidra locally. As such, the risk is confined to availability for local users, with no known remote exploitation path.