{"id":"CVE-2026-115394","kind":"vulnerability","aliases":["CVE-2026-115394"],"related":[],"title":"Ghidra: crafted GZF file exhausts memory and aborts import","description":"Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit length field. Attackers can persuade users to import a crafted GZF packed database file, triggering an OutOfMemoryError in PackedDatabase.open() that aborts the import and denies service.","summary":"Ghidra through 12.2 trusts a 32-bit length field in BinaryField.read(), so a crafted packed database file can make it allocate huge amounts of heap memory. Opening that file in Ghidra crashes the import with an OutOfMemoryError, which is a denial of service rather than code execution.","severity":"medium","cvss":6.8,"epss":0.00121,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","ghidra","other","reverse-engineering"],"not_affected_if":["no-gzf-import","own-files-only"],"how_to_check":"- Run `ghidra --version` or check the version shown in Help > About to see whether it is 12.2 or earlier\n- unknown if the sources list a specific fixed build","fix":"- Move to a Ghidra release newer than `12.2`\n- Do not import GZF packed database files from untrusted sources until upgraded\n- unknown if the sources name a fixed version","status":"open","published_at":"2026-10-22T19:17:47+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:42:49+00:00","updated_at":"2026-10-25T03:42:49+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T03:42:49Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Ghidra release newer than `12.2`\n- Do not import GZF packed database files from untrusted sources until upgraded\n- unknown if the sources name a fixed version","reach":"local","title":"Ghidra: crafted GZF file exhausts memory and aborts import","impact":"low","summary":"Ghidra through 12.2 trusts a 32-bit length field in BinaryField.read(), so a crafted packed database file can make it allocate huge amounts of heap memory. Opening that file in Ghidra crashes the import with an OutOfMemoryError, which is a denial of service rather than code execution.","category":"other","nicknames":[],"who_cares":["ghidra","reverse-engineering","desktop"],"confidence":0.7,"needs_auth":"no","worst_case":"Import crashes and the Ghidra session is denied service","analyst_note":"","how_to_check":"- Run `ghidra --version` or check the version shown in Help > About to see whether it is 12.2 or earlier\n- unknown if the sources list a specific fixed build","needs_analyst":false,"not_affected_if":["own-files-only","no-gzf-import"],"who_is_affected":"Teams that use Ghidra for reverse engineering and import shared GZF packed databases from outside their own organisation are the ones exposed. Users who only analyse their own binaries and never open files from third parties have little reason to worry. The sources do not describe a server-side or networked exposure.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000606,"input_tokens":3389,"output_tokens":534,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115394':12A,15A '-2026':11A,14A '12.2':24B,71C '32':27B,90C 'abort':8A,112C 'alloc':42B,76C 'allow':81C 'amount':44B 'attack':82C,94C 'binaryfield.read':32B,79C 'bit':28B,91C 'code':67B 'contain':72C 'craft':2A,35B,101C 'crash':53B 'cve':10A,13A 'databas':37B,104C 'deni':116C 'denial':62B 'desktop':16B 'engin':21B 'execut':68B 'exhaust':5A,84C 'field':30B,93C 'file':4A,38B,50B,105C 'ghidra':1A,17B,22B,52B,69C 'gzf':3A,102C 'heap':46B,85C 'huge':43B 'import':9A,55B,99C,114C 'length':29B,92C 'make':40B 'memori':6A,47B,75C,86C 'open':48B 'outofmemoryerror':58B,108C 'pack':36B,103C 'packeddatabase.open':110C 'persuad':96C 'rather':65B 'revers':20B 'reverse-engin':19B 'servic':64B,117C 'trigger':106C 'trust':25B 'uncheck':89C 'uncontrol':74C 'user':97C 'via':87C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Teams that use Ghidra for reverse engineering and import shared GZF packed databases from outside their own organisation are the ones exposed. Users who only analyse their own binaries and never open files from third parties have little reason to worry. The sources do not describe a server-side or networked exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115394","severity":null,"published_at":"2026-10-22T19:17:47+00:00","modified_at":"2026-10-23T17:05:04+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115394","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115394","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}