CVE-2026-115503EUVD-2026-108335GHSA-GMCQ-GG82-5FVCGHSA-MCJR-7QQR-M3W8
Ghidra before 12.2 Denial of Service via Compressed Extension Archive
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 12.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Ghidra, the reverse-engineering tool, is affected when it is run on a version earlier than 12.2. A crafted, highly compressed extension archive ("zip bomb") can be installed through it and expand without limit, filling the disk so that later file writes by Ghidra and other applications fail.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- NationalSecurityAgency ghidra
fixed in 12.2