CVE-2026-115503
CVE-2026-115503 · Ghidra before 12.2 Denial of Service via Compressed Extension Archive
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.
CVSS 6.8 · Mittel · EPSS 0,1% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
ghidra
- Softwareversionen
- ≥ 0, < 12.2: Betroffen (custom)
Auf 12.2 aktualisieren
Originalquellen
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mcjr-7qqr-m3w8
- https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784
- https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build
- https://github.com/NationalSecurityAgency/ghidra
- https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-compressed-extension-archive
- https://nvd.nist.gov/vuln/detail/CVE-2026-115503