Live › vulnerability › CVE-2026-115397
Go to dashboardGhidra before 12.2 extracts every entry of an extension ZIP without a file-count limit when installing it. A crafted archive with many files can exhaust filesystem inodes, so project writes and other processes on the machine fail.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Ghidra on a shared or workstation machine and install extension ZIP archives from outside sources. Users who only use built-in analysis features and never install extensions are not exposed to this path.
No product ranges from the sources yet.
ghidra --version or check the installed Ghidra version in the About dialog and confirm it is below 12.212.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a crafted extension archive with many files can exhaust filesystem inodes, causing project writes and other processes to fail.
This page as .md · .json · in your agent: get_signal("CVE-2026-115397")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.