CVE-2026-113604 NationalSecurityAgency CVE debrief

Who should care

Defenders responsible for Ghidra installations, especially those used for analyzing untrusted ELF files, should assess exposure and prioritize patching or mitigation. This includes operators of Ghidra deployments, platform administrators, vulnerability management teams, and security teams responsible for monitoring and incident response. These stakeholders should review the vulnerability details and take appropriate actions to protect their systems.

Why it matters

Defenders should care about CVE-2026-113604 because it can cause a denial of service in Ghidra installations, especially those handling untrusted ELF files. The vulnerability can be triggered by a crafted 128-byte ELF file, leading to an OutOfMemoryError. Defenders should prioritize patching or mitigating this vulnerability.

• Denial of service during load-spec discovery at import or in headless analysis pipelines
• Potential for OutOfMemoryError exceptions
• Need for patching or mitigating the vulnerability to prevent exploitation

Technical summary

The ELF loader's ElfHeader class in Ghidra 10.2 through 12.1.4 allocates arrays based on unvalidated extended section and program header counts. This can lead to an OutOfMemoryError when a crafted 128-byte ELF file is loaded, causing a denial of service. The vulnerability is triggered by a crafted ELF file that exploits the unvalidated counts, leading to excessive memory allocation. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Ghidra is used for analyzing untrusted ELF files.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Ghidra is used for analyzing untrusted ELF files.

Recommended defensive actions

• Patch Ghidra to version 12.1.5 or later
• Restrict access to Ghidra to trusted users and files
• Monitor Ghidra logs for OutOfMemoryError exceptions
• Implement additional logging and monitoring to detect potential exploitation attempts
• Conduct regular vulnerability assessments to identify exposed systems
• Review and update incident response plans to include denial of service scenarios
• Verify the integrity of ELF files before loading them into Ghidra

Evidence notes

The vulnerability is caused by the ELF loader's ElfHeader class allocating arrays sized by unvalidated extended section and program header counts. This can be triggered by a crafted 128-byte ELF file, leading to an OutOfMemoryError during load-spec discovery at import or in headless analysis pipelines.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.