Medium 6.8

Ghidra before 12.2 contains a resource allocation without limits vulnerability in...

CVE-2026-115398 First seen on SecPulse 04:14

Affected packages

Ecosystem	Package	Affected	Fixed
NationalSecurityAgency	ghidra	< 12.2	12.2

Original description The description as published by the source.

Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.5; CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4: Medium 6.8; CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Published: Oct 23, 2026
First seen on SecPulse: 04:14
GHSA: GHSA-xj66-h4r7-jmmx
CWE: CWE-770

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

Java

Attack Types

Denial of Service

CWE

Cwe 770

All

Nationalsecurityagency Ghidra

Detection sources

NIST National Vulnerability Database05:17
GitHub Security Advisories (Global)06:32
CVE.org (CVE Program・cvelistV5)04:14