Live › vulnerability › CVE-2026-115503
Go to dashboardGhidra before 12.2 unzips extension archives without size limits, so a crafted zip bomb expands until the disk is full. An attacker who gets a user to install that extension can make later writes by Ghidra and other applications fail.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Ghidra and install third-party extensions into it. Exposure depends on a user installing a crafted extension archive; sources do not say whether automated or shared installs are involved. Teams using only the bundled features or not installing extensions can skip it.
No product ranges from the sources yet.
Ghidra and check Help > About for the version; versions below 12.2 are affected.12.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.
This page as .md · .json · in your agent: get_signal("CVE-2026-115503")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.