CVE-2026-96273: Nationalsecurityagency Ghidra

Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days.

Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and prevents resource cleanup or graceful shutdown.

Affected products

• Nationalsecurityagency Ghidra: before 12.1.4 (fixed in 12.1.4)

Published 2026-09-23. Last modified 2026-09-28.