Live › vulnerability › CVE-2026-115396
Go to dashboardGhidra 10.3 before 12.2 does not limit decompressed size or compression ratio when ThemeReader.processIconFile() reads icon entries from a theme ZIP. A user who imports a crafted theme can have the icon entries expand until they fill the host filesystem, which then makes later writes fail.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Ghidra on a workstation or shared analysis host and import third-party Ghidra themes are exposed. The issue needs a user to import the crafted theme ZIP, so environments that never import outside themes can skip it.
No product ranges from the sources yet.
ghidra --version or check the installed Ghidra version in the About dialog and see whether it is 10.3 through 12.1.12.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.
This page as .md · .json · in your agent: get_signal("CVE-2026-115396")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.