Resource Allocation Issue in Ghidra by National Security Agency
CVE-2026-115397

6.8MEDIUM

Key Information:

Vendor

Nationalsecurityagency

Status
Ghidra
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115397?

A vulnerability exists in Ghidra prior to version 12.2 that allows attackers to exploit the ExtensionUtils.unzipToInstallationFolder() function. This flaw permits the extraction of ZIP archive entries without restrictions on file count, potentially overwhelming the filesystem's inode allocation. As a result, if a malicious user persuades victims to install a specially crafted extension, it can lead to exhaustion of filesystem resources, causing project writes and other essential processes to fail.

Affected Version(s)

ghidra 0 < 12.2

References

https://github.com/NationalSecurityAgency/ghidra/security...
vendor-advisory
https://github.com/NationalSecurityAgency/ghidra/commit/7...
patch
https://github.com/NationalSecurityAgency/ghidra/releases...
release-notes

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yuvraj Saxena (0xXA)
.