Vulnerability Description
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nsa | Ghidra | < 12.2 |
Related Weaknesses (CWE)
References
- https://github.com/NationalSecurityAgency/ghidraProduct
- https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418acPatch
- https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_buildRelease Notes
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mcjr-7Vendor Advisory
- https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-coThird Party Advisory
FAQ
What is CVE-2026-115503?
CVE-2026-115503 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persua...
How severe is CVE-2026-115503?
CVE-2026-115503 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-115503?
Check the references section above for vendor advisories and patch information. Affected products include: Nsa Ghidra.