In versions of the National Security Agency’s reverse‑engineering tool released before 12.1.3, the PDB parser can read a parameters section without size bounds. An attacker who supplies a crafted PDB file with an oversized parameters payload causes the parser’s internal list to expand without limit, triggering an OutOfMemoryError that bypasses normal exception handling. The resulting application crash prevents further analysis or processing, delivering a denial‑of‑service to the user. This flaw is a classic uncontrolled resource consumption weakness.

The affected software is the National Security Agency’s Ghidra reverse‑engineering suite, specifically any release older than 12.1.3. The vulnerability is present in all builds dependent on the legacy PDB parsing routine and is not limited to a specific sub‑component or module within Ghidra.

The CVSS score of 6.7 indicates a moderate severity vulnerability. No EPSS data is available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Since the flaw requires a crafted PDB file, the attack vector is likely local or administrative; an attacker must be able to load a malicious PDB into the application. The risk is mitigated by patching, but until the fix is applied, an attacker could interrupt the workflow of any analyst or automated process that imports large PDB files.