Medium 6.8

Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in...

CVE-2026-115395 First seen on SecPulse 04:14

Affected packages

Ecosystem	Package	Affected	Fixed
NationalSecurityAgency	ghidra	≥ 10.3, < 12.2	12.2

Original description The description as published by the source.

Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme archive with many small files, exhausting inodes and disk space to deny service to the host.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.5; CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4: Medium 6.8; CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Published: Oct 23, 2026
First seen on SecPulse: 04:14
GHSA: GHSA-hmjg-837r-prfv
CWE: CWE-770

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Denial of Service

CWE

Cwe 770

All

Nationalsecurityagency Ghidra

Detection sources

NIST National Vulnerability Database04:17
GitHub Security Advisories (Global)06:32
CVE.org (CVE Program・cvelistV5)04:14