Medium 6.8

Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils...

CVE-2026-115397 First seen on SecPulse 04:14

Affected packages

Ecosystem	Package	Affected	Fixed
NationalSecurityAgency	ghidra	< 12.2	12.2

Original description The description as published by the source.

Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a crafted extension archive with many files can exhaust filesystem inodes, causing project writes and other processes to fail.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.5; CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4: Medium 6.8; CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Published: Oct 23, 2026
First seen on SecPulse: 04:14
GHSA: GHSA-2jjf-r2xm-9jmp
CWE: CWE-770

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Denial of Service

CWE

Cwe 770

All

Nationalsecurityagency Ghidra

Detection sources

NIST National Vulnerability Database04:17
GitHub Security Advisories (Global)06:32
CVE.org (CVE Program・cvelistV5)04:14