Ghidra versions 10.2 through 12.1.4 include a flaw in the ELF loader’s ElfHeader class that allocates internal arrays based on unvalidated extended section and program header counts. A malicious user can craft a 128‑byte ELF file containing oversized counts, causing Ghidra to raise an OutOfMemoryError during load‑spec discovery or in headless analysis pipelines. The resulting crash interrupts the analysis process, leading to service disruption for users relying on Ghidra’s automated analysis features.

National Security Agency Ghidra, specifically versions 10.2, 10.3, 11.x, up to 12.1.4. These releases are affected; newer versions contain the patch.

The CVSS score of 6.8 indicates moderate severity, and the EPSS score is not available, so current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires that the attacker supply a crafted ELF file to Ghidra; this could be local if the victim runs Ghidra or remote if a headless service accepts ELF inputs over a network. Once the file is processed, an OutOfMemoryError triggers a denial of service, stopping the parsing and potentially blocking subsequent pipelines.