{"schema":"threatline.record/2","record":{"id":"GHSA-q538-hhhf-5jxp","aliases":["GHSA-q538-hhhf-5jxp"],"summary":" Denial of Service via Uncontrolled Memory Allocation in DB DataBuffer","details":"### Summary\r\n\r\nAn uncontrolled memory allocation vulnerability in the DB data buffer get() function allows attackers to cause denial of service. An attacker can supply a crafted DB binary with an arbitrarily large size value, forcing the parser to allocate excessive heap memory, crashing the Ghidra JVM.\r\n\r\n### Details\r\n\r\nWhen \"length\" is a very large value, it results in a Java Heap OOM error.\r\n\r\n[DataBuffer.java -  Line 164](https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Framework/DB/src/main/java/db/buffers/DataBuffer.java#L164):\r\n```\r\n\tpublic byte[] get(int offset, int length) throws IndexOutOfBoundsException {\r\n\t\tbyte[] bytes = new byte[length];        // a very large length can result in heap OOM\r\n\t\tSystem.arraycopy(data, offset, bytes, 0, bytes.length);\r\n\t\treturn bytes;\r\n\t}\r\n```\r\n\r\n[BinaryField.java -  Line 112](https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Framework/DB/src/main/java/db/BinaryField.java#L112):\r\n```\r\n\tint read(Buffer buf, int offset) throws IndexOutOfBoundsException, IOException {\r\n\t\tcheckImmutable();\r\n\t\tint len = buf.getInt(offset);\r\n\t\toffset += 4;\r\n\t\tif (len < 0) {\r\n\t\t\tdata = null;\r\n\t\t}\r\n\t\telse {\r\n\t\t\tdata = buf.get(offset, len); // Bug; Passed unsanitized len to get(), Implement a maxlen check.\r\n\t\t\toffset += len;\r\n\t\t}\r\n\t\treturn offset;\r\n\t}\r\n```\r\n\r\n[DBRecord.java -  Line 474](https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Framework/DB/src/main/java/db/DBRecord.java#L474):\r\n```\r\n\tpublic void read(Buffer buf, int offset) throws IndexOutOfBoundsException, IOException {\r\n\t\tfor (Field fieldValue : fieldValues) {\r\n\t\t\toffset = fieldValue.read(buf, offset);\r\n\t\t}\r\n\t\tdirty = false;\r\n\t}\r\n```\r\n\r\n### Fix\r\n\r\n\t1. Implement a maxlen check in DataBuffer.java's get(). If it's less than 0 or excessively large for an integer, return 0. No need to read it.\r\n\t2. Implement a maxlen check in BinaryField.java:read()\r\n\t3. First read length with readLength() then sanitize it in DBRecord.java ( line 472):\r\n```\r\n\tpublic void read(Buffer buf, int offset) throws IndexOutOfBoundsException, IOException {\r\n\t\tfor (Field fieldValue : fieldValues) {\r\n\t\t\tlen = fieldValue.readLength(buf, offset);      // Instead of reading directly, use readLength\r\n\t\t\tif (len >= 0)\r\n\t\t\t\toffset = fieldValue.read(buf, offset);\r\n\t\t}\r\n\t\tdirty = false;\r\n\t}\r\n```\r\n\r\n### Stack trace\r\n\r\n```\r\nJava heap space\r\njava.lang.OutOfMemoryError: Java heap space\r\n\tat db.buffers.DataBuffer.get(DataBuffer.java:164)\r\n\tat db.BinaryField.read(BinaryField.java:112)\r\n\tat db.DBRecord.read(DBRecord.java:474)\r\n\tat db.VarRecNode.getRecord(VarRecNode.java:201)\r\n\tat db.Table$LongKeyRecordIterator.hasNext(Table.java:2232)\r\n\tat db.MasterTable.<init>(MasterTable.java:61)\r\n\tat db.DBHandle.<init>(DBHandle.java:111)\r\n\tat ghidra.framework.store.db.PackedDBHandle.<init>(PackedDBHandle.java:58)\r\n\tat ghidra.framework.store.db.PackedDatabase.open(PackedDatabase.java:775)\r\n\tat ghidra.app.util.opinion.GzfLoader.loadPackedProgramDatabase(GzfLoader.java:103)\r\n\tat ghidra.app.util.opinion.GzfLoader.load(GzfLoader.java:76)\r\n\tat ghidra.plugin.importer.ImporterUtilities.importSingleFile(ImporterUtilities.java:463)\r\n\tat ghidra.plugin.importer.ImporterDialog.lambda$okCallback$0(ImporterDialog.java:376)\r\n\tat ghidra.plugin.importer.ImporterDialog$$Lambda/0x000000004bcfd000.monitoredRun(Unknown Source)\r\n\tat ghidra.util.task.TaskBuilder$TaskBuilderTask.run(TaskBuilder.java:306)\r\n\tat ghidra.util.task.Task.monitoredRun(Task.java:134)\r\n\tat ghidra.util.task.TaskRunner.lambda$startTaskThread$0(TaskRunner.java:106)\r\n\tat ghidra.util.task.TaskRunner$$Lambda/0x000000004bac8000.run(Unknown Source)\r\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1090)\r\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:614)\r\n\tat java.base/java.lang.Thread.runWith(Thread.java:1529)\r\n\tat java.base/java.lang.Thread.run(Thread.java:1516)\r\n```\r\n\r\n### Impact\r\n\r\nThis is a Denial of Service (DoS) vulnerability affecting automated binary analysis pipelines. An adversary distributing malicious software can intentionally supply malformed file, which when imported can instantly crash the Ghidra JVM, causing a loss of unsaved work and terminating the session. This is particularly damaging for automated triaging pipelines that use headless Ghidra instances, as a single malicious file can stall or crash the processing queue.\r\n","categories":["Unclassified"],"product":"ghidra","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-q538-hhhf-5jxp","source_modified_at":"2026-10-22T12:10:42Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"ghidra","name":"ghidra"},"range":"< 12.2"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-q538-hhhf-5jxp","source_modified_at":"2026-10-22T12:10:42Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"ghidra","name":"ghidra"},"version":"12.2"}],"cvss":6.7,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-22T12:10:42Z","modified_at":"2026-10-22T12:10:42Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-q538-hhhf-5jxp","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-22T12:10:42Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-22T12:10:42Z","content_hash":"b70e5c7bf30450cb9a198fe5c5b4b60af598ea91cff5598ab9220e96f893573c"}}