Vulnerability Description
Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nsa | Ghidra | >= 10.3, < 12.2 |
Related Weaknesses (CWE)
References
- https://github.com/NationalSecurityAgency/ghidraProduct
- https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418acPatch
- https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_buildRelease Notes
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-6mj8-xVendor Advisory
- https://www.vulncheck.com/advisories/ghidra-10.3-before-12.2-denial-of-service-vThird Party Advisory
FAQ
What is CVE-2026-115396?
CVE-2026-115396 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can...
How severe is CVE-2026-115396?
CVE-2026-115396 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-115396?
Check the references section above for vendor advisories and patch information. Affected products include: Nsa Ghidra.