CVE-2024-58350: Ghidra Use-After-Free in Sleigh Backend

Technical summary

CVE-2024-58350 is a use-after-free vulnerability in Ghidra's Sleigh backend caused by undefined static initialization order between the SleighArchitecture::translators and XmlArchitectureCapability singletons. During program termination, the destructors execute in an unsafe order, causing the code to iterate over deallocated memory. This triggers undefined behavior that typically manifests as an infinite loop or process hang. The vulnerability is classified under CWE-758 (Reliance on Undefined, Unspecified, or Implementation-Defined Behavior).

Business impact

The practical business impact is minimal. Ghidra is a specialized reverse-engineering tool used primarily by security researchers, malware analysts, and advanced development teams—not a widespread production system. The vulnerability only manifests during application shutdown, not during normal usage or analysis work. Organizations using Ghidra may experience minor inconvenience if the application hangs on exit, but no data loss, corruption, or lateral movement is possible. The low CVSS score (2.9) reflects this limited exposure.

Affected systems

Ghidra versions prior to 11.2 are vulnerable. The issue affects the Sleigh disassembly backend, which is a core component of the framework. However, only users running affected versions on local systems where an attacker has execution capability are at risk. This is not a network-exploitable vulnerability.

Exploitability

Exploitation requires local code execution on a system running a vulnerable Ghidra version. An attacker must be able to run code or trigger application shutdown on the target machine. The vulnerability is not remotely exploitable and does not grant elevated privileges or access to sensitive data. Real-world exploitation is unlikely given the limited user base and low impact.

Remediation

Update Ghidra to version 11.2 or later. The update addresses the static initialization order issue, ensuring safe destruction of singletons. Organizations should prioritize this update as part of routine maintenance rather than emergency patching.

Patch guidance

Download and install Ghidra 11.2 or the latest available version from the official NSA repository. Verify the integrity of the download against provided checksums. For organizations with centralized Ghidra deployments, coordinate the update with affected teams to minimize disruption. No special migration steps or configuration changes are required.

Detection guidance

Monitor for Ghidra processes that hang or exit abnormally during shutdown. In environments where Ghidra version inventory is maintained, scan systems to identify instances running versions before 11.2. Process monitoring can detect infinite loops at shutdown, though this is a minor operational indicator. No behavioral signatures are needed for active exploitation, as the vulnerability only manifests at termination.

Why prioritize this

This vulnerability should not drive urgent action. The combination of low severity (CVSS 2.9), local-only exploitation requirements, and limited real-world impact means it can be addressed through standard patching cycles. Organizations should update when convenient, but do not require emergency response protocols. Prioritize other vulnerabilities affecting broader attack surfaces or critical systems.

Risk score, explained

The CVSS 3.1 score of 2.9 reflects: attack vector of Local (requires local execution), attack complexity of High (specific conditions needed to trigger during shutdown), and impact limited to Availability (denial of service only). The vulnerability requires an attacker to already have execution capability on the target system, which is a significant barrier. No confidentiality or integrity impact is possible.

Frequently asked questions