PT-2026-48406 · U.S. National Security Agency · Ghidra

Donghwoo Cho · Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-49495

NVD

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() that lacks cycle detection when traversing Mach-O binary export tries. A crafted Mach-O binary with circular references in the export trie causes unbounded queue growth and exponential string concatenation, triggering OutOfMemoryError that crashes the entire JVM and loses all unsaved work.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2026-49495

Affected Products

Ghidra

References · 3

• https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-wm33-9f68-3vjg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49495 · Security Note
• https://vulncheck.com/advisories/ghidra-denial-of-service-via-circular-reference-in-mach-o-export-trie-parser · Note