CVE-2026-96273: Ghidra DOS Vulnerability

CVE-2026-96273 Overview

CVE-2026-96273 is a denial of service vulnerability affecting Ghidra, the open-source software reverse engineering framework maintained by the National Security Agency. Versions before 12.1.4 fail to validate the TYPE_COL byte inside OptionsDB.createUnregisteredOption(). The unchecked value triggers an ArrayIndexOutOfBoundsException during program import. The exception propagates without releasing the lock on the domain object, leaving it permanently locked.

Critical Impact
A crafted program database file can stall Ghidra on import, block resource cleanup, and prevent graceful shutdown of the analysis session.

Affected Products

Ghidra versions prior to 12.1.4
Ghidra 12.1.3 build (confirmed vulnerable via referenced source line range)
Fixed in Ghidra release 12.1.4

Discovery Timeline

2026-09-23 - CVE-2026-96273 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96273

Vulnerability Analysis

The flaw is classified as [CWE-460] Improper Cleanup on Thrown Exception. The affected code path is in Ghidra/Framework/Project/src/main/java/ghidra/framework/data/OptionsDB.java, specifically the createUnregisteredOption() method. When Ghidra imports a program database file, it reads a TYPE_COL byte to determine the option type. The method uses this byte as an array index without bounds validation.

A malicious value outside the valid range triggers an ArrayIndexOutOfBoundsException. The exception is raised inside a code region that has already acquired a lock on the domain object through AbstractTransactionManager. Because the lock increment happens before the operation, and no finally block previously guarded the decrement, the exception aborts the call while lockCount remains elevated. The domain object stays locked for the lifetime of the process. Ghidra cannot save, close, or clean up the resource, and orderly shutdown is blocked.

Root Cause

Two defects combine to produce the impact. First, createUnregisteredOption() does not validate the TYPE_COL byte before using it as an index. Second, AbstractTransactionManager incremented lockCount prior to a call that could throw, without a finally clause to reverse the increment on failure. The patch addresses the second defect by wrapping the operation in try/finally and decrementing the lock count when the operation does not complete successfully.

Attack Vector

Exploitation requires an analyst to import an attacker-supplied program database file into Ghidra. The attack vector is local and requires user interaction. No authentication to Ghidra is required, since Ghidra runs under the local user account. The result is denial of service of the Ghidra session, not code execution or data disclosure.

java

// Patch excerpt from AbstractTransactionManager.java (GP-7190)
// Source: https://github.com/NationalSecurityAgency/ghidra/commit/594da048431aab082a9da7c4a965874d07d33310

            lockReason = reason;
            ++lockCount;
        }

        boolean success = false;
        try {
            if (doPrepare) {
                for (DomainObjectAdapterDB domainObj : getDomainObjects()) {
                    if (domainObj.isChanged()) {
                        domainObj.prepareToSave();
                    }
                }
            }
            success = true;
            return true;
        }
        finally {
            if (!success) {
                --lockCount;
            }
        }
    }

The patch ensures lockCount is decremented when an exception like ArrayIndexOutOfBoundsException is thrown during prepareToSave(), preventing the permanent lock condition.

Detection Methods for CVE-2026-96273

Indicators of Compromise

Ghidra process consuming a stable set of resources but unresponsive after an import operation.
Java stack traces containing ArrayIndexOutOfBoundsException originating from OptionsDB.createUnregisteredOption().
Domain object lock states that persist across normal save or close attempts inside the Ghidra project window.
Program database (.gzf, .gpr project files) received from untrusted sources prior to the hang.

Detection Strategies

Monitor Ghidra log files and console output for the specific exception path in ghidra.framework.data.OptionsDB.
Alert on Ghidra Java processes that remain running with import-related threads blocked beyond expected analysis time.
Inspect program database files with static parsers to flag out-of-range TYPE_COL byte values before opening in Ghidra.

Monitoring Recommendations

Track installed Ghidra versions across analyst workstations and flag any release older than 12.1.4.
Log the origin of imported program database files to correlate hangs with untrusted sources.
Capture Java Flight Recorder or thread dumps from Ghidra sessions to identify held locks on domain objects.

How to Mitigate CVE-2026-96273

Immediate Actions Required

Upgrade all Ghidra installations to release Ghidra 12.1.4 or later.
Do not import program database files received from untrusted or unverified sources on vulnerable versions.
Review the GitHub Security Advisory GHSA-4w7g-wmg8-fgv5 for vendor guidance.

Patch Information

The National Security Agency released Ghidra 12.1.4 containing commit 594da04 (GP-7190). The fix wraps the lock-holding operation in AbstractTransactionManager with a try/finally block that decrements lockCount when the guarded call throws. Additional details are available in the VulnCheck advisory.

Workarounds

Restrict Ghidra imports to program database files produced by trusted internal pipelines until the upgrade is complete.
Run Ghidra inside a disposable virtual machine or container so a hung session can be terminated without disrupting analyst workflows.
Use file provenance controls to reject .gzf and project archives from external sources during triage.

bash

# Verify the installed Ghidra version on Linux/macOS analyst workstations
grep application.version "$GHIDRA_INSTALL_DIR/Ghidra/application.properties"

# Expected output on a patched host:
# application.version=12.1.4