CVE-2026-115397: Ghidra before 12.2 Denial of Service via Extension Archive Install
Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a crafted extension archive with many files can exhaust filesystem inodes, causing project writes and other processes to fail.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghidrato a version that resolves this vulnerability.Fixed in 12.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Ghidra versions before 12.2 are exposed when they install an extension archive. The impact is exhaustion of filesystem inodes, which can prevent Ghidra project writes and affect other processes sharing the filesystem.
What must an attacker do to trigger the denial of service?
An attacker must persuade a user to install a crafted extension ZIP archive containing a very large number of entries. Exploitation requires local interaction by the user, but does not require attacker privileges.
Are installations affected without installing an extension?
The vulnerable behavior occurs while extracting an extension archive during installation. The provided information does not indicate that ordinary use without installing a crafted extension triggers the issue.