An uncontrolled 32‑bit length field in Ghidra’s BinaryField.read() allows an attacker to trigger an uncontrolled heap allocation. When a malicious GZF packed database file is imported, PackedDatabase.open() throws an OutOfMemoryError and aborts the operation, leaving the application unresponsive. The vulnerability is a classic example of an uncontrolled memory allocation flaw, classified as CWE‑789, and it compromises the availability of the Ghidra environment but does not provide direct data disclosure or remote code execution.

The flaw affects National Security Agency Ghidra binaries through version 12.2. Any installation that allows import of GZF files – including standalone users, shared workstations, or team environments – is susceptible. The issue does not depend on specific OS or configuration beyond the presence of the vulnerable Ghidra build.

The CVSS vector for this vulnerability is 6.8, indicating a moderate severity that can disrupt continuous use of Ghidra. No EPSS score is currently published, so the exploitation probability cannot be quantified from the available data. The vulnerability is not listed in the CISA KEV catalog. Attackers would typically acquire the victim’s context by sending a crafted GZF file and enticing the user to import it, suggesting a local or user‑prompted attack vector rather than a remote network exploit.