Improper Handling of Compressed Data in Ghidra by National Security Agency
CVE-2026-115396

6.8MEDIUM

Key Information:

Vendor

Nationalsecurityagency

Status
Ghidra
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115396?

Ghidra versions prior to 12.2 exhibit a vulnerability related to improper handling of highly compressed data within the ThemeReader.processIconFile() function. This flaw allows attackers to create specially crafted theme ZIP files that, when imported, can expand icon entries excessively, consuming available filesystem space. This can lead to a denial of service as legitimate data writes are obstructed by the exhaustion of storage capacity.

Affected Version(s)

ghidra 10.3 < 12.2

References

https://github.com/NationalSecurityAgency/ghidra/security...
vendor-advisory
https://github.com/NationalSecurityAgency/ghidra/commit/2...
patch
https://github.com/NationalSecurityAgency/ghidra/releases...
release-notes

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yuvraj Saxena (0xXA)
.