Ghidra versions 10.2 through 12.0 contain an uncontrolled resource consumption bug in the ExportTrie.parseTrie() routine. When a Mach‑O binary with circular references in its export trie is parsed, the algorithm grows an unbounded queue and performs exponential string concatenation. This leads to an OutOfMemoryError that crashes the Java Virtual Machine, terminating the analysis session and discarding any unsaved work. The weakness is a classic lack of resource limiting, classified as CWE‑835.

The National Security Agency’s Ghidra platform, from version 10.2 up to 12.0, is affected. Versions 12.1 and later include the necessary cycle detection logic and are not vulnerable. Any deployment of Ghidra that loads user‑supplied or externally provided Mach‑O binaries using these affected releases is at risk.

The CVSS score of 6.7 indicates a moderate severity. No EPSS value is available, and the flaw is not listed in the CISA KEV catalog, indicating it is not yet known to be exploited in the wild. The effect is local; an attacker would need to supply a crafted Mach‑O binary to a user running Ghidra, causing an application crash. The vulnerability cannot be leveraged for remote code execution but can still disrupt analysis workflows when malicious or corrupt binary files are processed.