{"id":"CVE-2026-115397","kind":"vulnerability","aliases":["CVE-2026-115397"],"related":[],"title":"Ghidra: extension install with many files exhausts filesystem inodes","description":"Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a crafted extension archive with many files can exhaust filesystem inodes, causing project writes and other processes to fail.","summary":"Ghidra before 12.2 extracts every entry of an extension ZIP without a file-count limit when installing it. A crafted archive with many files can exhaust filesystem inodes, so project writes and other processes on the machine fail.","severity":"medium","cvss":6.8,"epss":0.00121,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ghidra","package","reverse-engineering","workstation"],"not_affected_if":["ghidra-12.2-or-later","no-third-party-extensions"],"how_to_check":"- Run `ghidra --version` or check the installed Ghidra version in the About dialog and confirm it is below `12.2`\n- Confirm whether any users install third-party Ghidra extensions from untrusted archives","fix":"- Upgrade Ghidra to `12.2` or later\n- Only install extensions from trusted sources until upgraded","status":"open","published_at":"2026-10-22T19:17:47+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:42:46+00:00","updated_at":"2026-10-25T03:42:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:42:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Ghidra to `12.2` or later\n- Only install extensions from trusted sources until upgraded","reach":"local","title":"Ghidra: extension install with many files exhausts filesystem inodes","impact":"low","summary":"Ghidra before 12.2 extracts every entry of an extension ZIP without a file-count limit when installing it. A crafted archive with many files can exhaust filesystem inodes, so project writes and other processes on the machine fail.","category":"package","nicknames":[],"who_cares":["ghidra","reverse-engineering","workstation"],"confidence":0.7,"needs_auth":"no","worst_case":"Filesystem inodes exhausted, causing write failures for other processes","analyst_note":"","how_to_check":"- Run `ghidra --version` or check the installed Ghidra version in the About dialog and confirm it is below `12.2`\n- Confirm whether any users install third-party Ghidra extensions from untrusted archives","needs_analyst":false,"not_affected_if":["ghidra-12.2-or-later","no-third-party-extensions"],"who_is_affected":"Teams that run Ghidra on a shared or workstation machine and install extension ZIP archives from outside sources. Users who only use built-in analysis features and never install extensions are not exposed to this path.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00058,"input_tokens":3367,"output_tokens":486,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115397':12A,15A '-2026':11A,14A '12.2':24B,63C 'alloc':67C 'archiv':43B,93C 'attack':83C 'caus':101C 'contain':64C 'count':36B,82C 'craft':42B,91C 'cve':10A,13A 'engin':20B 'entri':27B,78C 'everi':26B,75C 'exhaust':7A,48B,98C 'extens':2A,30B,76C,92C 'extensionutils.unziptoinstallationfolder':72C 'extract':25B,74C 'fail':60B,108C 'file':6A,35B,46B,81C,96C 'file-count':34B 'filesystem':8A,49B,99C 'ghidra':1A,16B,22B,61C 'inod':9A,50B,100C 'instal':3A,39B,89C 'limit':37B,69C,80C 'machin':59B 'mani':5A,45B,95C 'packag':17B 'persuad':85C 'process':56B,106C 'project':52B,102C 'resourc':66C 'revers':19B 'reverse-engin':18B 'user':87C 'vulner':70C 'without':32B,68C,79C 'workstat':21B 'write':53B,103C 'zip':31B,77C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Ghidra on a shared or workstation machine and install extension ZIP archives from outside sources. Users who only use built-in analysis features and never install extensions are not exposed to this path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115397","severity":null,"published_at":"2026-10-22T19:17:47+00:00","modified_at":"2026-10-23T17:05:04+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115397","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115397","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}