Medium severity · published Jun 10, 2026
CVE-2024-58350
Ghidra < 11.2 - Use After Free in Sleigh Backend via Static Initialization Order
4.0
CVSS
0.1%
EPSS
No
On KEV
Description
Ghidra before 11.2 contains a use after free vulnerability in the Sleigh backend caused by undefined static initialization order of the SleighArchitecture::translators and XmlArchitectureCapability singletons. Attackers can trigger an infinite loop or denial of service during shutdown by exploiting the unsafe destruction order that causes iteration over deallocated memory.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GH
ghidra · nationalsecurityagency
before 11.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-58350
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-58350
Vendor Advisory
https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-4g43-2f29-xvp4
Third Party Advisory
https://www.vulncheck.com/advisories/ghidra-use-after-free-in-sleigh-backend-via-static-initialization-order
More from ghidra
8.8
CVE-2026-52758
Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search
8.8
CVE-2026-52754
Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule
8.8
CVE-2026-52751
Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection
8.8
CVE-2026-49498
Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username
7.8
CVE-2026-52755
Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import