← Back

Ghidra

ghidra

Vendor: Nsa • 25 CVEs

CVEs (25)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-17665
1Nsa
1Ghidra
Jun 17, 2026
Oct 16, 2019
N/A· v4
7.8 HIGH· v3
4.4 MEDIUM· v2
NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working directory.
CVE-2019-17664
1Nsa
1Ghidra
Jun 17, 2026
Oct 16, 2019
N/A· v4
7.8 HIGH· v3
4.4 MEDIUM· v2
NSA Ghidra through 9.0.4 uses a potentially untrusted search path. When executing Ghidra from a given path, the Java process working directory is set to this path. Then, when launching the Python interpreter via the "Ghi...Show more
NSA Ghidra through 9.0.4 uses a potentially untrusted search path. When executing Ghidra from a given path, the Java process working directory is set to this path. Then, when launching the Python interpreter via the "Ghidra Codebrowser > Window > Python" option, Ghidra will try to execute the cmd.exe program from this working directory.Show less
CVE-2019-16941
1Nsa
1Ghidra
Jun 17, 2026
Sep 28, 2019
N/A· v4
9.8 CRITICAL· v3
6.8 MEDIUM· v2
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document. This occurs in Features/BytePatter...Show more
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document. This occurs in Features/BytePatterns/src/main/java/ghidra/bitpatterns/info/FileBitPatternInfoReader.java. An attack could start with an XML document that was originally created by DumpFunctionPatternInfoScript but then directly modified by an attacker (for example, to make a java.lang.Runtime.exec call).Show less
CVE-2019-13625
1Nsa
1Ghidra
Jun 17, 2026
Jul 17, 2019
N/A· v4
9.1 CRITICAL· v3
9.4 HIGH· v2
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file.
CVE-2019-13623
1Nsa
1Ghidra
Jun 17, 2026
Jul 17, 2019
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. This allows attacke...Show more
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. This allows attackers to overwrite arbitrary files in scenarios where an intermediate analysis result is archived for sharing with other persons. To achieve arbitrary code execution, one approach is to overwrite some critical Ghidra modules, e.g., the decompile module.Show less