{"id":"CVE-2026-115396","kind":"vulnerability","aliases":["CVE-2026-115396"],"related":[],"title":"Ghidra: crafted theme ZIP can fill disk and break later writes","description":"Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.","summary":"Ghidra 10.3 before 12.2 does not limit decompressed size or compression ratio when ThemeReader.processIconFile() reads icon entries from a theme ZIP. A user who imports a crafted theme can have the icon entries expand until they fill the host filesystem, which then makes later writes fail.","severity":"medium","cvss":6.8,"epss":0.00121,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-workstations","ghidra","other","reverse-engineering"],"not_affected_if":["ghidra-12.2-or-later","no-theme-imports"],"how_to_check":"- Run `ghidra --version` or check the installed Ghidra version in the About dialog and see whether it is `10.3` through `12.1`.\n- unknown","fix":"- Upgrade Ghidra to `12.2` or later.\n- Only import theme files from trusted sources until the upgrade is done.","status":"open","published_at":"2026-10-22T19:17:47+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:42:47+00:00","updated_at":"2026-10-25T03:42:47+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:42:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Ghidra to `12.2` or later.\n- Only import theme files from trusted sources until the upgrade is done.","reach":"local","title":"Ghidra: crafted theme ZIP can fill disk and break later writes","impact":"low","summary":"Ghidra 10.3 before 12.2 does not limit decompressed size or compression ratio when ThemeReader.processIconFile() reads icon entries from a theme ZIP. A user who imports a crafted theme can have the icon entries expand until they fill the host filesystem, which then makes later writes fail.","category":"other","nicknames":[],"who_cares":["ghidra","reverse-engineering","developer-workstations"],"confidence":0.6,"needs_auth":"no","worst_case":"Host filesystem fills up, so later writes fail","analyst_note":"","how_to_check":"- Run `ghidra --version` or check the installed Ghidra version in the About dialog and see whether it is `10.3` through `12.1`.\n- unknown","needs_analyst":false,"not_affected_if":["no-theme-imports","ghidra-12.2-or-later"],"who_is_affected":"Teams that run Ghidra on a workstation or shared analysis host and import third-party Ghidra themes are exposed. The issue needs a user to import the crafted theme ZIP, so environments that never import outside themes can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000591,"input_tokens":3373,"output_tokens":508,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115396':14A,17A '-2026':13A,16A '10.3':27B,73C '12.2':29B,75C 'attack':96C 'break':9A 'caus':116C 'compress':36B,82C,94C 'contain':76C 'craft':2A,52B,104C 'cve':12A,15A 'data':83C 'decompress':33B,91C 'develop':19B 'developer-workst':18B 'disk':7A 'engin':25B 'entri':42B,58B,109C 'expand':59B,110C 'fail':71B,88C,120C 'filesystem':65B,115C 'fill':6A,62B,112C 'ghidra':1A,21B,26B,72C 'handl':79C 'high':81C 'host':64B,114C 'icon':41B,57B,108C 'import':50B,102C 'improp':78C 'later':10A,69B,117C 'limit':32B,90C 'make':68B 'persuad':98C 'ratio':37B,95C 'read':40B 'revers':24B 'reverse-engin':23B 'size':34B,92C 'theme':3A,45B,53B,105C 'themereader.processiconfile':39B,86C 'user':48B,100C 'vulner':84C 'whose':107C 'workstat':20B 'write':11A,70B,118C 'zip':4A,46B,106C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Ghidra on a workstation or shared analysis host and import third-party Ghidra themes are exposed. The issue needs a user to import the crafted theme ZIP, so environments that never import outside themes can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115396","severity":null,"published_at":"2026-10-22T19:17:47+00:00","modified_at":"2026-10-23T17:05:04+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115396","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115396","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}