CVE-2026-115396
Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive
- State
- Published
- Severity
- 6.8 Medium
- Published
- Oct 22, 2026
- Updated
- Oct 29, 2026
- Reserved
- Oct 22, 2026
Description
Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.5 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
Affected Products
| Product | Versions |
|---|---|
ghidraNationalSecurityAgency |
|
References
- GitHub Security Advisory (GHSA-6mj8-x8x9-7gxq)vendor-advisory
- https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784patch
- ghidra Ghidra_12.2_build Release Notesrelease-notes
- https://github.com/NationalSecurityAgency/ghidraproduct
- VulnCheck Advisory: Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archivethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.