Live › vulnerability › CVE-2026-115395
Go to dashboardGhidra's theme reader extracts every entry of an imported theme ZIP into the images directory without limit. A crafted archive with many small files can exhaust inodes and disk space, denying service to the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that use Ghidra and import theme ZIP archives, especially from outside sources, on shared or small-disk machines. Exposure depends on a user being persuaded to import a crafted theme; the sources do not say whether automated pipelines import themes.
No product ranges from the sources yet.
ghidra --version or check the installed Ghidra version in the application properties; unknown whether the sources give a specific command.12.2.12.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme archive with many small files, exhausting inodes and disk space to deny service to the host.
This page as .md · .json · in your agent: get_signal("CVE-2026-115395")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.