{"schema":"threatline.record/2","record":{"id":"GHSA-6mj8-x8x9-7gxq","aliases":["GHSA-6mj8-x8x9-7gxq"],"summary":"Improper Handling of Highly Compressed Theme Archive Causes Denial of Service","details":"### Summary\r\n\r\nA maliciously crafted theme archive can cause uncontrolled resource consumption during theme import because the importer processes attacker-controlled ZIP entries without enforcing an effective limit on their decompressed size. A relatively small malicious archive can therefore cause the importer to consume a substantially larger amount of disk space, potentially exhausting the available space on the host filesystem. Once the filesystem is exhausted, subsequent imports and other applications that require disk writes may fail, resulting in a denial-of-service condition and loss of system availability.\r\n\r\n### Details\r\n\r\n`readZipTheme()` is responsible for extracting theme data and icons from a theme ZIP archive. In particular, icons are extracted from the `image/` subdirectory of the archive to `/home/USERNAME/.config/ghidra/Ghidra*/images` on the host filesystem. If an archive contains an icon file larger than the available disk space on the host partition, the extraction can exhaust all available disk space, preventing further imports. Additionally, applications on the affected system that depend on disk I/O may become unable to function properly.\r\n\r\n### Impact\r\n\r\nThe vulnerability allows an attacker to cause uncontrolled resource consumption by supplying a highly compressed ZIP entry with a very large decompressed size.\r\n\r\nThis can result in:\r\n1. excessive disk-space consumption;\r\n2. excessive CPU and I/O usage during decompression;\r\n3. failure of subsequent import operations;\r\n5. inability to perform other operations when system resources are exhausted; and potentially denial of service if sufficient resources are consumed.\r\n\r\n**Note: Once all available disk space is exhausted, other system-wide applications that depend on disk I/O may fail or become unable to perform write operations.**\r\n\r\n### Subsequent System Impact\r\n\r\n[yuvraj@archlinux ~]$ df\r\nFilesystem     1K-blocks      Used Available Use% Mounted on\r\ndev              1847472         0   1847472   0% /dev\r\nrun              1942264      1768   1940496   1% /run\r\nefivarfs             384       314        66  83% /sys/firmware/efi/efivars\r\n/dev/sda2      121453232 115237348       256 100%                                // DISK FULLY CONSUMED\r\n/ tmpfs            1942264      3120   1939144   1% /dev/shm\r\nnone                1024         0      1024   0% /run/credentials/systemd-journald.service\r\ntmpfs            1942268         4   1942264   1% /tmp\r\n/dev/sda1        1046508    175652    870856  17% /boot\r\ntmpfs             388452        52    388400   1% /run/user/1000","categories":["Unclassified"],"product":"ghidra","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-6mj8-x8x9-7gxq","source_modified_at":"2026-10-22T12:09:01Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"ghidra","name":"ghidra"},"range":">= 10.3"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-6mj8-x8x9-7gxq","source_modified_at":"2026-10-22T12:09:01Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"ghidra","name":"ghidra"},"version":"12.2"}],"cvss":8.3,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-22T12:09:01Z","modified_at":"2026-10-22T12:09:01Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-6mj8-x8x9-7gxq","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-22T12:09:01Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-22T12:09:01Z","content_hash":"a149fe6117234b303dd65b2b425f4b860c353ecacc3c745acba126f8af1d73ac"}}