CVE-2026-115397GHSA-j5q9-fhqg-q995
Ghidra before 12.2 Denial of Service via Extension Archive Install
NationalSecurityAgency ghidra
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 12.2ghidraCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a crafted extension archive with many files can exhaust filesystem inodes, causing project writes and other processes to fail.
Text from CVE List
Affected versions 1
- ghidraaffected: all versions before 12.2CVE List
References 5
- github.com/NationalSecurityAgency/ghidra/commit/7cb4e778efb69acb1919f841ad46d0da36e77eebFixvia CVE List
- github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_buildFixvia CVE List
- github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-j5q9-fhqg-q995Advisoryvia CVE List
- github.com/NationalSecurityAgency/ghidraAdvisoryvia CVE List
- vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-extension-archive-installAdvisoryvia CVE List