CVE-2026-96273 — Ghidra before 12.1.4 Denial of Service via Unreleased Lock in OptionsDB
Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanentl…
Published: 2026-09-23 · CVSS: 6.8 · CVSS 4.0
Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and prevents resource cleanup or graceful shutdown.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7