CVE-2026-115395: Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()
Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme archive with many small files, exhausting inodes and disk space to deny service to the host.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Ghidra versions 10.3 through versions before 12.2 are exposed if they import a crafted theme archive. Exploitation requires local interaction by a user; it is not described as remotely exploitable without user involvement.
What does an attacker need to do to exploit it?
An attacker needs to persuade a user to import a malicious theme ZIP archive containing many small files. The archive causes ThemeReader.readZipTheme() to extract unlimited entries into the images directory.
What is the impact on an affected host?
The crafted archive can exhaust filesystem inodes and disk space, resulting in denial of service on the host. The provided information does not indicate confidentiality or integrity impact.
What should be done if patching is not immediately possible?
Do not import untrusted theme archives, particularly ZIP files obtained from unverified sources. Restrict theme imports to archives that have been reviewed or obtained from trusted sources.