PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-115397 NationalSecurityAgency CVE debrief

Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a crafted extension archive with many files can exhaust filesystem inodes, causing project writes and other processes to fail.

Vendor
NationalSecurityAgency
Product
ghidra
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-29
Advisory published
2026-10-22
Advisory updated
2026-10-29

Who should care

Defenders responsible for Ghidra installations, developers using Ghidra, and security teams assessing exposure to crafted extension archives should be aware of this vulnerability and take necessary actions to verify and protect their systems.

Why it matters

Defenders should prioritize verifying Ghidra installations and assessing exposure to crafted extension archives to prevent Denial of Service incidents and potential security risks.

  • Denial of Service (DoS) incidents due to exhausted filesystem inodes.
  • Potential project write failures and process disruptions.
  • Need for verification of Ghidra installations to ensure version 12.2 or later is used.
  • Possible security risks if untrusted extensions are installed.

Technical summary

The vulnerability in Ghidra before 12.2 is caused by a resource allocation without limits in ExtensionUtils.unzipToInstallationFolder(). This allows attackers to exhaust filesystem inodes by installing a crafted extension archive with many files, leading to project writes and other processes failing. Defenders should prioritize verifying Ghidra installations and assessing exposure to crafted extension archives to prevent Denial of Service incidents and potential security risks. The NationalSecurityAgency vendor provides additional information through GitHub Security Advisory and release notes.

Defensive priority

Defenders should prioritize verifying Ghidra installations and assessing exposure to crafted extension archives.

Recommended defensive actions

  • Verify Ghidra installations to ensure version 12.2 or later is used.
  • Assess exposure to crafted extension archives and limit user installation of untrusted extensions.
  • Monitor for and respond to potential Denial of Service (DoS) incidents related to Ghidra.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability in Ghidra before 12.2. The NationalSecurityAgency vendor provides additional information through GitHub Security Advisory and release notes.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-115397 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-115397

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-115397 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-115397

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Ghidra before 12.2 Denial of Service via Extension Archive Install

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115397.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-j5q9-fhqg-q995

    Supplemental source - vendor-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/NationalSecurityAgency/ghidra/commit/7cb4e778efb69acb1919f841ad46d0da36e77eeb

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://github.com/NationalSecurityAgency/ghidra

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-extension-archive-install

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.