CVE-2026-115503
Ghidra before 12.2 Denial of Service via Compressed Extension Archive
- State
- Published
- Severity
- 6.8 Medium
- Published
- Oct 22, 2026
- Updated
- Oct 22, 2026
- Reserved
- Oct 22, 2026
Description
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.5 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
Affected Products
| Product | Versions |
|---|---|
ghidraNationalSecurityAgency |
|
References
- GitHub Security Advisory (GHSA-mcjr-7qqr-m3w8)vendor-advisory
- https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784patch
- ghidra Ghidra_12.2_build Release Notesrelease-notes
- https://github.com/NationalSecurityAgency/ghidraproduct
- VulnCheck Advisory: Ghidra before 12.2 Denial of Service via Compressed Extension Archivethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.