Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck
CVE-2026-115395Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()
Medium 5.5
In plain English
A medium-severity resource allocation without limits in ghidra from NationalSecurityAgency. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.1%top 97.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme archive with many small files, exhausting inodes and disk space to deny service to the host.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NationalSecurityAgency | ghidra | 10.3 – before 12.2 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-fvwx-pwq5-3738) vendor-advisory
- https://github.com/NationalSecurityAgency/ghidra/commit/b0762c3e728a6a26d80ed4943c2efd53e2569120 patch
- ghidra Ghidra_12.2_build Release Notes release-notes
- https://github.com/NationalSecurityAgency/ghidra product
- VulnCheck Advisory: Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme() third-party-advisory