CVE-2026-115396GHSA-6mj8-x8x9-7gxq
Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive
NationalSecurityAgency ghidra
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 12.2ghidraCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.
Text from CVE List
Affected versions 1
- ghidraaffected: 10.3 before 12.2CVE List
References 5
- github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784Fixvia CVE List
- github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_buildFixvia CVE List
- github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-6mj8-x8x9-7gxqAdvisoryvia CVE List
- github.com/NationalSecurityAgency/ghidraAdvisoryvia CVE List
- vulncheck.com/advisories/ghidra-10.3-before-12.2-denial-of-service-via-compressed-theme-archiveAdvisoryvia CVE List