CVE-2026-115398: Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.
Affected Software
Event History
Frequently Asked Questions
Which use cases are exposed to this issue?
Users of Ghidra versions before 12.2 are exposed when they open or batch-import TAR or ZIP archives. The affected archive file systems store archive entries without limits, allowing a crafted archive with excessive entries to consume Java heap memory.
What does an attacker need to do to trigger the denial of service?
An attacker must persuade a user to open or batch-import a crafted TAR or ZIP archive containing an excessive number of entries. No attacker privileges are required, but user interaction is required.
What is the practical impact if exploitation succeeds?
Exploitation can exhaust the Java heap and cause the Ghidra session to hang. The provided information describes an availability impact only, with no confidentiality or integrity impact.
What remediation is available?
Upgrade Ghidra to version 12.2 or later. The issue affects versions before 12.2.