Live › vulnerability › CVE-2026-115398
Go to dashboardGhidra before 12.2 stores an unbounded number of entries when it indexes TAR and ZIP archives through FileSystemIndexHelper. A crafted archive with excessive entries can exhaust the Java heap and hang the session, a denial of service rather than code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Ghidra before 12.2 and open or batch-import archives they did not create. The risk depends on a person being persuaded to open a crafted archive, so analysts working only on their own binaries are less exposed.
No product ranges from the sources yet.
ghidra --version or check the version shown in the Ghidra About dialog and compare against 12.212.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.
This page as .md · .json · in your agent: get_signal("CVE-2026-115398")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.