ghidra: Improper Handling of Highly Compressed Extension Archive Causes Denial of Service

Summary

A maliciously crafted extension archive can cause uncontrolled resource consumption during extension import because the importer processes attacker-controlled ZIP entries without enforcing an effective limit on their decompressed size. A relatively small malicious archive can therefore cause the importer to consume a substantially larger amount of disk space, potentially exhausting the available space on the host filesystem. Once the filesystem is exhausted, subsequent imports and other applications that require disk writes may fail, resulting in a denial-of-service condition and loss of system availability.

Details

unzipToInstallationFolder() is responsible for extracting Ghidra extension ZIP archives. Files from the archive are extracted directly to /home/USERNAME/.config/ghidra/Ghidra*/Extensions on the host filesystem. If an archive contains a file larger than the available disk space on the host partition, the extraction can exhaust all available disk space, preventing subsequent imports. Additionally, other applications on the affected system that depend on disk I/O may fail or become unable to perform required write operations.

Stack Trace

2026-08-27 13:28:47 ERROR (ExtensionUtils) Error Installing Extension: Unexpected error installing extension java.io.IOException: No space left on device
	at java.base/java.io.FileOutputStream.writeBytes(Native Method)
	at java.base/java.io.FileOutputStream.write(FileOutputStream.java:352)
	at java.base/java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:123)
	at java.base/java.io.BufferedOutputStream.write(BufferedOutputStream.java:188)
	at org.apache.commons.io.IOUtils.copyLarge(IOUtils.java:1457)
	at org.apache.commons.io.IOUtils.copy(IOUtils.java:1081)
	at org.apache.commons.io.IOUtils.copyLarge(IOUtils.java:1429)
	at org.apache.commons.io.IOUtils.copy(IOUtils.java:1059)
	at ghidra.util.extensions.ExtensionUtils.writeZipEntryToFile(ExtensionUtils.java:634)
	at ghidra.util.extensions.ExtensionUtils.unzipToInstallationFolder(ExtensionUtils.java:597)
	at ghidra.util.extensions.ExtensionUtils.install(ExtensionUtils.java:103)
	at ghidra.framework.project.extensions.ExtensionInstaller.lambda$install$0(ExtensionInstaller.java:97)
	at ghidra.util.task.TaskLauncher$2.run(TaskLauncher.java:115)
	at ghidra.util.task.Task.monitoredRun(Task.java:134)
	at ghidra.util.task.TaskRunner.lambda$startTaskThread$0(TaskRunner.java:106)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1090)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:614)
	at java.base/java.lang.Thread.run(Thread.java:1516)
	Suppressed: java.io.IOException: No space left on device
		at java.base/java.io.FileOutputStream.writeBytes(Native Method)
		at java.base/java.io.FileOutputStream.write(FileOutputStream.java:352)
		at java.base/java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:123)
		at java.base/java.io.BufferedOutputStream.flush(BufferedOutputStream.java:203)
		at java.base/java.io.FilterOutputStream.close(FilterOutputStream.java:184)
		at ghidra.util.extensions.ExtensionUtils.writeZipEntryToFile(ExtensionUtils.java:630)
		... 9 more
 
2026-08-27 13:30:03 ERROR (IndexedV1LocalFileSystem) Failed to flush index file java.io.IOException: error occurred while writing filesystem index: /home/yuvraj/buc.rep/versioned/~index.tmp                           /////////       DISK IS FULL THEREFORE NO OPERATION WILL SUCCEEDD
	at ghidra.framework.store.local.IndexedLocalFileSystem.writeIndex(IndexedLocalFileSystem.java:314)
	at ghidra.framework.store.local.IndexedLocalFileSystem.flushIndex(IndexedLocalFileSystem.java:269)
	at ghidra.framework.store.local.IndexedLocalFileSystem.dispose(IndexedLocalFileSystem.java:198)

Impact

The vulnerability allows an attacker to cause uncontrolled resource consumption by supplying a highly compressed ZIP entry with a very large decompressed size.

This can result in:

1. excessive disk-space consumption;
2. excessive CPU and I/O usage during decompression;
3. failure of subsequent import operations;
4. inability to perform other operations when system resources are exhausted; and potentially denial of service if sufficient resources are consumed.

Note: Once all available disk space is exhausted, other system-wide applications that depend on disk I/O may fail or become unable to perform write operations.

Subsequent System Impact

[yuvraj@archlinux ~]$ df Filesystem 1K-blocks Used Available Use% Mounted on dev 1847472 0 1847472 0% /dev run 1942264 1768 1940496 1% /run efivarfs 384 314 66 83% /sys/firmware/efi/efivars /dev/sda2 121453232 115237348 256 100% // DISK FULLY CONSUMED / tmpfs 1942264 3120 1939144 1% /dev/shm none 1024 0 1024 0% /run/credentials/systemd-journald.service tmpfs 1942268 4 1942264 1% /tmp /dev/sda1 1046508 175652 870856 17% /boot tmpfs 388452 52 388400 1% /run/user/1000