The vulnerability is an uncontrolled memory allocation in the Mach‑O parser, allowing an attacker to supply a crafted binary with an extremely large ncmds load‑command count. The parser then allocates memory proportional to that count without validating the actual file size, causing the Ghidra JVM to run out of memory and terminate. The weakness is defined as CWE‑789 and results in a denial of service of the Ghidra analysis session.

All Ghidra releases prior to version 12.1.1 are affected. Users running Ghidra 12.0 or earlier must update to 12.1.1 or later to eliminate the flaw.

The CVSS score of 6.7 indicates a medium severity risk, with no EPSS data available and no inclusion in the CISA KEV catalog, suggesting current exploitation is low but the vulnerability could be targeted in environments that routinely process user‑supplied binaries. The likely attack vector is a local or remote user that can supply a malicious Mach‑O file to Ghidra, perhaps via an automated analysis pipeline, causing the application to crash and deny service to legitimate users.