{"schema":"threatline.record/2","record":{"id":"GHSA-fvwx-pwq5-3738","aliases":["GHSA-fvwx-pwq5-3738"],"summary":"Denial of Service via Filesystem Inode Exhaustion During Theme Import","details":"### Summary\r\n\r\nA maliciously crafted theme archive containing a very large number of files can cause the theme importer to exhaust the available filesystem inodes. Once inode pool is exhausted, subsequent imports and file creation operations fail, preventng ghidra and other system services from creating files and resulting in a denial-of-service condition and loss of system availability.\r\n\r\n### Details\r\n\r\n`readZipTheme()` is responsible for extracting theme data and icons from a theme ZIP archive. In particular, icons are extracted from the `image/` subdirectory of the archive to `/home/USERNAME/.config/ghidra/Ghidra*/images` on the host filesystem. If an archive contains a very large number of icon files, the extraction can exhaust all available inode pool and disk space, preventing further imports. Additionally, applications on the affected system that depend on disk I/O may become unable to function properly.\r\n\r\n### Impact\r\n\r\nThe vulnerability allows an attacker to cause uncontrolled resource consumption by supplying a malicious archive with a very large number of files.\r\n\r\nThis can result in:\r\n1. excessive disk-space consumption;\r\n2. excessive CPU and I/O usage during decompression;\r\n3. failure of subsequent import operations;\r\n6. inability to perform other operations when inode pool is exhausted; and potentially denial of service if sufficient resources are consumed.\r\n\r\n**Note: Once available inode pool is exhausted, other system-wide applications that depend on disk I/O may fail or become unable to perform write operations.**","categories":["Unclassified"],"product":"ghidra","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-fvwx-pwq5-3738","source_modified_at":"2026-10-22T12:08:01Z","fetched_at":"2026-10-24T18:03:20.872036Z","package":{"ecosystem":"ghidra","name":"ghidra"},"range":"< 12.2"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-fvwx-pwq5-3738","source_modified_at":"2026-10-22T12:08:01Z","fetched_at":"2026-10-24T18:03:20.872036Z","package":{"ecosystem":"ghidra","name":"ghidra"},"version":"12.2"}],"cvss":8.3,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-22T12:08:01Z","modified_at":"2026-10-22T12:08:01Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-fvwx-pwq5-3738","fetched_at":"2026-10-24T18:03:20.872036Z","source_modified_at":"2026-10-22T12:08:01Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-22T12:08:01Z","content_hash":"35c21000ee7fb7bd758f68b100c9dd35defb930afee9dbf9a6ba2cd40ca9e2d0"}}