CVE-2026-115396

EUVD-2026-108332
Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.
Data Amplification
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 1.8%
Common Weakness Enumeration
References
https://github.com/NationalSecurityAgency/ghidra
https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784
https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build
https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-6mj8-x8x9-7gxq
https://www.vulncheck.com/advisories/ghidra-10.3-before-12.2-denial-of-service-via-compressed-theme-archive