{"schema":"threatline.record/2","record":{"id":"GHSA-mcjr-7qqr-m3w8","aliases":["GHSA-mcjr-7qqr-m3w8"],"summary":"Improper Handling of Highly Compressed Extension Archive Causes Denial of Service","details":"### Summary\r\n\r\nA maliciously crafted extension archive can cause uncontrolled resource consumption during extension import because the importer processes attacker-controlled ZIP entries without enforcing an effective limit on their decompressed size. A relatively small malicious archive can therefore cause the importer to consume a substantially larger amount of disk space, potentially exhausting the available space on the host filesystem. Once the filesystem is exhausted, subsequent imports and other applications that require disk writes may fail, resulting in a denial-of-service condition and loss of system availability.\r\n\r\n### Details\r\n\r\n`unzipToInstallationFolder()` is responsible for extracting Ghidra extension ZIP archives. Files from the archive are extracted directly to `/home/USERNAME/.config/ghidra/Ghidra*/Extensions` on the host filesystem. If an archive contains a file larger than the available disk space on the host partition, the extraction can exhaust all available disk space, preventing subsequent imports. Additionally, other applications on the affected system that depend on disk I/O may fail or become unable to perform required write operations.\r\n\r\n### Stack Trace\r\n\r\n```\r\n2026-08-27 13:28:47 ERROR (ExtensionUtils) Error Installing Extension: Unexpected error installing extension java.io.IOException: No space left on device\r\n\tat java.base/java.io.FileOutputStream.writeBytes(Native Method)\r\n\tat java.base/java.io.FileOutputStream.write(FileOutputStream.java:352)\r\n\tat java.base/java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:123)\r\n\tat java.base/java.io.BufferedOutputStream.write(BufferedOutputStream.java:188)\r\n\tat org.apache.commons.io.IOUtils.copyLarge(IOUtils.java:1457)\r\n\tat org.apache.commons.io.IOUtils.copy(IOUtils.java:1081)\r\n\tat org.apache.commons.io.IOUtils.copyLarge(IOUtils.java:1429)\r\n\tat org.apache.commons.io.IOUtils.copy(IOUtils.java:1059)\r\n\tat ghidra.util.extensions.ExtensionUtils.writeZipEntryToFile(ExtensionUtils.java:634)\r\n\tat ghidra.util.extensions.ExtensionUtils.unzipToInstallationFolder(ExtensionUtils.java:597)\r\n\tat ghidra.util.extensions.ExtensionUtils.install(ExtensionUtils.java:103)\r\n\tat ghidra.framework.project.extensions.ExtensionInstaller.lambda$install$0(ExtensionInstaller.java:97)\r\n\tat ghidra.util.task.TaskLauncher$2.run(TaskLauncher.java:115)\r\n\tat ghidra.util.task.Task.monitoredRun(Task.java:134)\r\n\tat ghidra.util.task.TaskRunner.lambda$startTaskThread$0(TaskRunner.java:106)\r\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1090)\r\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:614)\r\n\tat java.base/java.lang.Thread.run(Thread.java:1516)\r\n\tSuppressed: java.io.IOException: No space left on device\r\n\t\tat java.base/java.io.FileOutputStream.writeBytes(Native Method)\r\n\t\tat java.base/java.io.FileOutputStream.write(FileOutputStream.java:352)\r\n\t\tat java.base/java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:123)\r\n\t\tat java.base/java.io.BufferedOutputStream.flush(BufferedOutputStream.java:203)\r\n\t\tat java.base/java.io.FilterOutputStream.close(FilterOutputStream.java:184)\r\n\t\tat ghidra.util.extensions.ExtensionUtils.writeZipEntryToFile(ExtensionUtils.java:630)\r\n\t\t... 9 more\r\n \r\n2026-08-27 13:30:03 ERROR (IndexedV1LocalFileSystem) Failed to flush index file java.io.IOException: error occurred while writing filesystem index: /home/yuvraj/buc.rep/versioned/~index.tmp                           /////////       DISK IS FULL THEREFORE NO OPERATION WILL SUCCEEDD\r\n\tat ghidra.framework.store.local.IndexedLocalFileSystem.writeIndex(IndexedLocalFileSystem.java:314)\r\n\tat ghidra.framework.store.local.IndexedLocalFileSystem.flushIndex(IndexedLocalFileSystem.java:269)\r\n\tat ghidra.framework.store.local.IndexedLocalFileSystem.dispose(IndexedLocalFileSystem.java:198)\r\n```\r\n\r\n### Impact\r\n\r\nThe vulnerability allows an attacker to cause uncontrolled resource consumption by supplying a highly compressed ZIP entry with a very large decompressed size.\r\n\r\nThis can result in:\r\n1. excessive disk-space consumption;\r\n2. excessive CPU and I/O usage during decompression;\r\n3. failure of subsequent import operations;\r\n6. inability to perform other operations when system resources are exhausted; and potentially denial of service if sufficient resources are consumed.\r\n\r\n**Note: Once all available disk space is exhausted, other system-wide applications that depend on disk I/O may fail or become unable to perform write operations.**\r\n\r\n### Subsequent System Impact\r\n\r\n[yuvraj@archlinux ~]$ df\r\nFilesystem     1K-blocks      Used Available Use% Mounted on\r\ndev              1847472         0   1847472   0% /dev\r\nrun              1942264      1768   1940496   1% /run\r\nefivarfs             384       314        66  83% /sys/firmware/efi/efivars\r\n/dev/sda2      121453232 115237348       256 100%                                // DISK FULLY CONSUMED\r\n/ tmpfs            1942264      3120   1939144   1% /dev/shm\r\nnone                1024         0      1024   0% /run/credentials/systemd-journald.service\r\ntmpfs            1942268         4   1942264   1% /tmp\r\n/dev/sda1        1046508    175652    870856  17% /boot\r\ntmpfs             388452        52    388400   1% /run/user/1000","categories":["Unclassified"],"product":"ghidra","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mcjr-7qqr-m3w8","source_modified_at":"2026-10-22T12:09:11Z","fetched_at":"2026-10-26T06:00:26.954813Z","package":{"ecosystem":"ghidra","name":"ghidra"},"range":"< 12.2"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mcjr-7qqr-m3w8","source_modified_at":"2026-10-22T12:09:11Z","fetched_at":"2026-10-26T06:00:26.954813Z","package":{"ecosystem":"ghidra","name":"ghidra"},"version":"12.2"}],"cvss":8.2,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-22T12:09:11Z","modified_at":"2026-10-22T12:09:11Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mcjr-7qqr-m3w8","fetched_at":"2026-10-26T06:00:26.954813Z","source_modified_at":"2026-10-22T12:09:11Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-22T12:09:11Z","content_hash":"3ec6d7a9a889cc791cbe0eb111bba64a440d6f562e37bbb5524c754571933799"}}