CVE-2026-115503Medium· 5.5▾ SunlitGhidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bom…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.
ghidra < 12.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115396Medium· 5.5Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive
CVE-2026-115398Medium· 5.5Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount
CVE-2026-115395Medium· 5.5Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()
CVE-2026-115397Medium· 5.5Ghidra before 12.2 Denial of Service via Extension Archive Install
CVE-2026-115394Medium· 5.5Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation
CVE-2026-100505Medium· 4.4Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length