Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck
CVE-2026-115503Ghidra before 12.2 Denial of Service via Compressed Extension Archive
Medium 5.5
In plain English
A medium-severity security flaw in ghidra from NationalSecurityAgency. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.1%top 97.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NationalSecurityAgency | ghidra | 0 – before 12.2 |
Weakness: CWE-409 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-mcjr-7qqr-m3w8) vendor-advisory
- https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784 patch
- ghidra Ghidra_12.2_build Release Notes release-notes
- https://github.com/NationalSecurityAgency/ghidra product
- VulnCheck Advisory: Ghidra before 12.2 Denial of Service via Compressed Extension Archive third-party-advisory