Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck
CVE-2026-115396Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive
Medium 5.5
In plain English
A medium-severity security flaw in ghidra from NationalSecurityAgency. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.1%top 97.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NationalSecurityAgency | ghidra | 10.3 – before 12.2 |
Weakness: CWE-409 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-6mj8-x8x9-7gxq) vendor-advisory
- https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784 patch
- ghidra Ghidra_12.2_build Release Notes release-notes
- https://github.com/NationalSecurityAgency/ghidra product
- VulnCheck Advisory: Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive third-party-advisory