CVE-2026-115398GHSA-vvp8-22p8-x954
Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount
NationalSecurityAgency ghidra
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 12.2ghidraCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.
Text from CVE List
Affected versions 1
- ghidraaffected: all versions before 12.2CVE List
References 5
- github.com/NationalSecurityAgency/ghidra/commit/061ec06a79f4147267f6fc690b0dcf944b2d4957Fixvia CVE List
- github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_buildFixvia CVE List
- github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vvp8-22p8-x954Advisoryvia CVE List
- github.com/NationalSecurityAgency/ghidraAdvisoryvia CVE List
- vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-tar-and-zip-file-system-mountAdvisoryvia CVE List