CVE-2026-115503: Ghidra before 12.2 Denial of Service via Compressed Extension Archive
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghidrato a version that resolves this vulnerability.Fixed in 12.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Ghidra versions before 12.2 are exposed when they install an attacker-crafted extension archive. Exploitation requires persuading a user to perform that installation.
Is a default installation affected without user interaction?
The provided information indicates that user interaction is required. The crafted archive must be installed as a Ghidra extension for disk space exhaustion to occur.
What is the impact if exploitation succeeds?
The extension archive can expand without size limits and exhaust available disk space. This can cause subsequent writes by Ghidra and other applications to fail.
What version addresses the issue?
Ghidra 12.2 is identified as the release boundary; versions before 12.2 are affected.