CVE-2026-96273

MediumCVSS 5.5/10Last modified Sep 28, 2026

Description

Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and prevents resource cleanup or graceful shutdown.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-460 CWE-667

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Sep 28, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-962747.4In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contain CVE-2026-962758.8A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extrac CVE-2026-962766.5If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writabl CVE-2026-962778.7Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. This issue affects Apache T CVE-2026-962787.2The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up CVE-2026-962796.5A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak applicati CVE-2026-96288.8A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is an unknown function of the file /goform/formPptpClientCon CVE-2026-962807.5The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit sy CVE-2026-962816.2On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing CVE-2026-962823.1A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host direc CVE-2026-962833.3By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from inter CVE-2026-962842.5A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI