{"id":"CVE-2026-115395","kind":"vulnerability","aliases":["CVE-2026-115395"],"related":[],"title":"Ghidra: theme ZIP import writes unlimited files, exhausting disk and inodes","description":"Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme archive with many small files, exhausting inodes and disk space to deny service to the host.","summary":"Ghidra's theme reader extracts every entry of an imported theme ZIP into the images directory without limit. A crafted archive with many small files can exhaust inodes and disk space, denying service to the host.","severity":"medium","cvss":6.8,"epss":0.00121,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ghidra","package","reverse-engineering","security-research"],"not_affected_if":["no-theme-import","version-12.2-or-later"],"how_to_check":"- Run `ghidra --version` or check the installed Ghidra version in the application properties; unknown whether the sources give a specific command.\n- Confirm whether the installed version is earlier than `12.2`.","fix":"- Upgrade Ghidra to `12.2` or later.\n- Import theme archives only from trusted sources until upgraded.","status":"open","published_at":"2026-10-22T19:17:47+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:42:47+00:00","updated_at":"2026-10-25T03:42:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:42:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Ghidra to `12.2` or later.\n- Import theme archives only from trusted sources until upgraded.","reach":"local","title":"Ghidra: theme ZIP import writes unlimited files, exhausting disk and inodes","impact":"low","summary":"Ghidra's theme reader extracts every entry of an imported theme ZIP into the images directory without limit. A crafted archive with many small files can exhaust inodes and disk space, denying service to the host.","category":"package","nicknames":[],"who_cares":["ghidra","reverse-engineering","security-research"],"confidence":0.6,"needs_auth":"no","worst_case":"Host disk and inodes exhausted, causing denial of service","analyst_note":"","how_to_check":"- Run `ghidra --version` or check the installed Ghidra version in the application properties; unknown whether the sources give a specific command.\n- Confirm whether the installed version is earlier than `12.2`.","needs_analyst":false,"not_affected_if":["version-12.2-or-later","no-theme-import"],"who_is_affected":"Teams that use Ghidra and import theme ZIP archives, especially from outside sources, on shared or small-disk machines. Exposure depends on a user being persuaded to import a crafted theme; the sources do not say whether automated pipelines import themes.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000584,"input_tokens":3380,"output_tokens":493,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115395':14A,17A '-2026':13A,16A '10.3':63C '12.2':65C 'alloc':69C 'archiv':46B,94C 'attack':85C 'contain':66C 'craft':45B,92C 'cve':12A,15A 'deni':57B,105C 'directori':41B,84C 'disk':9A,55B,102C 'engin':22B 'entri':32B,80C 'everi':31B 'exhaust':8A,52B,99C 'extract':30B,76C 'file':7A,50B,98C 'ghidra':1A,18B,26B,62C 'host':61B,109C 'imag':40B,83C 'import':4A,35B,90C 'inod':11A,53B,100C 'limit':43B,71C 'mani':48B,96C 'packag':19B 'persuad':87C 'reader':29B 'research':25B 'resourc':68C 'revers':21B 'reverse-engin':20B 'secur':24B 'security-research':23B 'servic':58B,106C 'small':49B,97C 'space':56B,103C 'theme':2A,28B,36B,78C,93C 'themereader.readziptheme':74C 'unlimit':6A,77C 'user':88C 'vulner':72C 'without':42B,70C 'write':5A 'zip':3A,37B,79C","nicknames":[],"mitigations":[],"who_affected":"Teams that use Ghidra and import theme ZIP archives, especially from outside sources, on shared or small-disk machines. Exposure depends on a user being persuaded to import a crafted theme; the sources do not say whether automated pipelines import themes.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115395","severity":null,"published_at":"2026-10-22T19:17:47+00:00","modified_at":"2026-10-23T17:05:04+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115395","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115395","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}