CVE-2026-115503GHSA-mcjr-7qqr-m3w8
Ghidra before 12.2 Denial of Service via Compressed Extension Archive
NationalSecurityAgency ghidra
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 12.2ghidraCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.
Text from CVE List
Affected versions 1
- ghidraaffected: all versions before 12.2CVE List
References 5
- github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784Fixvia CVE List
- github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_buildFixvia CVE List
- github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mcjr-7qqr-m3w8Advisoryvia CVE List
- github.com/NationalSecurityAgency/ghidraAdvisoryvia CVE List
- vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-compressed-extension-archiveAdvisoryvia CVE List