CVE-2026-115398 NationalSecurityAgency CVE debrief

Who should care

Defenders responsible for systems using Ghidra versions before 12.2 should assess their exposure and prioritize verifying the impact of this vulnerability. They should also consider upgrading to Ghidra version 12.2 or later and monitor for potential denial of service attacks. Additionally, defenders should review compensating controls for exposed systems and track exceptions and retest remediated assets.

Why it matters

Defenders should care about CVE-2026-115398 because it allows for a denial of service in Ghidra versions before 12.2, potentially leading to session hangs and Java heap exhaustion. Those responsible for systems using Ghidra should verify their exposure, assess the impact, and consider upgrading to version 12.2 or later.

• Denial of service via excessive TAR or ZIP archive entries
• Potential for session hang due to Java heap exhaustion
• Need for verification of Ghidra version and exposure
• Priority for upgrading to Ghidra version 12.2 or later

Technical summary

The vulnerability in Ghidra before 12.2 is caused by a resource allocation without limits in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem. This allows attackers to create crafted TAR or ZIP archives with excessive entries, leading to a denial of service. The vulnerability can be exploited by persuading a user to open or batch-import a malicious archive, which can exhaust the Java heap and hang the session. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using Ghidra versions before 12.2.

Recommended defensive actions

• Verify Ghidra version and assess exposure
• Evaluate the impact of this vulnerability on your systems
• Consider upgrading to Ghidra version 12.2 or later
• Monitor for potential denial of service attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details about the vulnerability in Ghidra before 12.2. The vulnerability allows for a denial of service via TAR and ZIP file system mount. The source item includes references to the vendor advisory, patch, release notes, and product information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.