PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-115503 NationalSecurityAgency CVE debrief

Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.

Vendor
NationalSecurityAgency
Product
ghidra
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Defenders responsible for Ghidra installations, developers using Ghidra, and security teams assessing exposure to crafted zip bomb extension archives should be aware of this vulnerability.

Why it matters

Defenders should prioritize verifying Ghidra installations and assessing exposure to crafted zip bomb extension archives to prevent denial-of-service attacks.

  • Disk space exhaustion leading to application failures.
  • Potential performance issues due to highly compressed data.
  • Verification of Ghidra version and exposure to crafted archives is necessary.

Technical summary

The vulnerability in Ghidra before 12.2 allows attackers to cause a denial of service by exhausting disk space through a crafted zip bomb extension archive. This vulnerability is due to improper handling of highly compressed data in ExtensionUtils.unzipToInstallationFolder(). Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail. Defenders should prioritize verifying Ghidra installations and assessing exposure to crafted zip bomb extension archives.

Defensive priority

Defenders should prioritize verifying Ghidra installations and assessing exposure to crafted zip bomb extension archives.

Recommended defensive actions

  • Verify Ghidra installations to ensure version 12.2 or later is used.
  • Assess exposure to crafted zip bomb extension archives.
  • Implement monitoring for disk space usage and application performance issues related to Ghidra.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability in Ghidra before 12.2. The NationalSecurityAgency is the affected vendor. Evidence limits suggest defenders verify Ghidra installations and assess exposure to crafted zip bomb extension archives. Defenders should prioritize verifying Ghidra installations and assessing exposure to crafted zip bomb extension archives to prevent denial-of-service attacks.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-115503 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-115503

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-115503 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-115503

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Ghidra before 12.2 Denial of Service via Compressed Extension Archive

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115503.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mcjr-7qqr-m3w8

    Supplemental source - vendor-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://github.com/NationalSecurityAgency/ghidra

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-compressed-extension-archive

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.