CVE-2026-54389— Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb
Quick assessment
Affected
NationalSecurityAgency ghidra
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Ghidra 12.1.3 之前的版本中，PDB 解析器存在一处不受控制的资源消耗漏洞。攻击者通过提供构造的 PDB 文件，特别是其中包含过大的参数部分，可终止 Ghidra 进程。AbstractPdb 的反序列化例程会将所有剩余参数读入一个无界列表，从而导致堆内存无限制增长，触发 OutOfMemoryError（内存溢出错误）。该异常未被正常处理，最终导致应用程序崩溃。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| NationalSecurityAgency | ghidra | < 12.1.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54389
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb
Source: CVE Program / CVE List V5
Vulnerability Description
Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters into an unbounded list, causing uncontrolled heap growth that triggers an OutOfMemoryError which bypasses exception handling and crashes the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| NationalSecurityAgency | ghidra | 0 ~ 12.1.3 | - |
|
II. Public POCs for CVE-2026-54389
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54389
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-54389 (1)
Vendor Pages for CVE-2026-54389 (1)
IV. Related Vulnerabilities
Same product: ghidra
-
CVE-2026-18718
Ghidra Swift Demangler Analyzer Arbitrary Code Execution via -
CVE-2026-52759
Ghidra < 12.1.1 - Denial of Service via Uncontrolled Memory -
CVE-2026-52758
Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in -
CVE-2026-52757
Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() -
CVE-2026-52756
Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger I
Same vendor: NationalSecurityAgency
-
CVE-2026-52758
Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in -
CVE-2026-52757
Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() -
CVE-2026-52756
Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger I -
CVE-2026-52755
Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Impor -
CVE-2026-52754
Ghidra < 12.1 - Authentication Bypass via Null Signature in
Same weakness: CWE-770
-
CVE-2026-78321
DJI Drone HTTP Media Server Denial of Service via Connection -
CVE-2026-59279
Unbounded persistent session allocation via repeated initial -
CVE-2026-17170
Vulnerabilities in IBM AIX and PowerVM VIOS -
CVE-2026-17163
Vulnerabilities in IBM AIX and PowerVM VIOS -
CVE-2026-67447
Mailpit: SMTP DATA line reader buffers over-limit input befo
V. Comments for CVE-2026-54389
No comments yet