Medium severity · published Oct 22, 2026
CVE-2026-115396
Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive
New
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GH
ghidra · NationalSecurityAgency
10.3 before 12.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115396
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115396
github.com
https://github.com/NationalSecurityAgency/ghidra
github.com
https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784
github.com
https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build
github.com
https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-6mj8-x8x9-7gxq
www.vulncheck.com
https://www.vulncheck.com/advisories/ghidra-10.3-before-12.2-denial-of-service-via-compressed-theme-archive
More from ghidra
8.8
CVE-2026-52758
Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search
8.8
CVE-2026-52754
Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule
8.8
CVE-2026-52751
Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection
8.8
CVE-2026-49498
Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username
7.8
CVE-2026-52755
Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import