CVE-2026-115396: Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive
Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Ghidra versions from 10.3 through versions before 12.2 are exposed when they import a theme ZIP supplied by an untrusted source. Exploitation requires local interaction by a user; it is not described as remotely exploitable without that import action.
What does an attacker need to do to trigger the denial of service?
An attacker needs to persuade a user to import a crafted theme ZIP containing highly compressed icon entries. The entries expand during processing and can consume filesystem space, causing subsequent writes on the host to fail.
Is there an identified fixed release?
Yes. The affected range is stated as Ghidra 10.3 before 12.2, so upgrading to Ghidra 12.2 addresses the affected version range.
What can be done if an upgrade cannot be performed immediately?
Do not import theme ZIP files from untrusted sources. Restrict theme imports to archives that have been reviewed or obtained from trusted sources, since importing the crafted archive is required for exploitation.