CVE-2026-54389— Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-54389
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb
Source: CVE Program / CVE List V5
Vulnerability Description
Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters into an unbounded list, causing uncontrolled heap growth that triggers an OutOfMemoryError which bypasses exception handling and crashes the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| NationalSecurityAgency | ghidra | 0 ~ 12.1.3 | - |
II. Public POCs for CVE-2026-54389
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54389
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-54389 (1)
Vendor Pages for CVE-2026-54389 (1)
IV. Related Vulnerabilities
Same product: ghidra
- CVE-2026-18718
Ghidra Swift Demangler Analyzer Arbitrary Code Execution via - CVE-2026-52759
Ghidra < 12.1.1 - Denial of Service via Uncontrolled Memory - CVE-2026-52758
Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in - CVE-2026-52757
Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() - CVE-2026-52756
Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger I
Same vendor: NationalSecurityAgency
- CVE-2026-52758
Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in - CVE-2026-52757
Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() - CVE-2026-52756
Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger I - CVE-2026-52755
Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Impor - CVE-2026-52754
Ghidra < 12.1 - Authentication Bypass via Null Signature in
Same weakness: CWE-770
- CVE-2026-17170
Vulnerabilities in IBM AIX and PowerVM VIOS - CVE-2026-17163
Vulnerabilities in IBM AIX and PowerVM VIOS - CVE-2026-67447
Mailpit: SMTP DATA line reader buffers over-limit input befo - CVE-2026-74836
HTTP/2 connection-window starvation pins Plug processes inde - CVE-2026-53585
libgit2: Unbounded Memory Allocation via Delta Object Result
V. Comments for CVE-2026-54389
No comments yet