CVE-2026-115395 in Ghidra
Summary
by MITRE • 10/22/2026
Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme archive with many small files, exhausting inodes and disk space to deny service to the host.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The Ghidra software suite, specifically versions prior to 12.2, contains a critical resource allocation vulnerability within its ThemeReader component that allows for denial of service attacks through uncontrolled resource consumption. This flaw resides in the readZipTheme method, which is responsible for parsing and extracting theme archives used to customize the graphical user interface of the reverse engineering platform. The core technical deficiency lies in the absence of validation mechanisms regarding the number or size of entries within a ZIP archive before extraction begins. When a user imports a maliciously crafted theme file containing an excessively large number of small files, the application proceeds to extract every single entry into the designated images directory without imposing any limits on disk space usage or inode allocation. This behavior violates fundamental principles of secure coding related to resource management and input validation, as the software fails to anticipate or mitigate scenarios where external inputs are designed to exhaust system resources rather than provide legitimate styling data.
From a technical perspective, this vulnerability is classified under CWE-770: Allocation of Resources Without Limits or Throttling, which describes situations where an application allocates computational resources without proper bounds, leading to potential denial of service conditions. The attack vector relies on social engineering tactics, requiring the victim to manually import a specially constructed ZIP archive into Ghidra. Once processed, the extraction process creates thousands or millions of files in rapid succession. This action rapidly depletes available disk space and exhausts inode counts, particularly on file systems with limited inode allocations such as ext3 or certain configurations of NTFS. The exhaustion of these resources renders the host system unable to create new files, effectively causing a denial of service not only for Ghidra but potentially impacting other applications running on the same filesystem that require write access.
The operational impact of this vulnerability extends beyond simple application instability. By exhausting disk space and inodes, an attacker can disrupt critical operations on the affected machine, including system updates, log writing, and temporary file creation by other processes. This aligns with ATT&CK technique T1496: Resource Hijacking, where attackers use resources to cause a denial of service or degrade performance for legitimate users. While Ghidra is primarily used in controlled security research environments, the ability to crash the host system through a simple file import highlights significant risks in tools that handle untrusted inputs from various sources. The lack of input sanitization means that any theme archive obtained from unofficial repositories or malicious actors can be weaponized against analysts and developers who rely on Ghidra for their daily tasks.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. Users should immediately upgrade to Ghidra version 12.2 or later, where this vulnerability has been addressed by implementing strict limits on the number of files extracted from theme archives. For environments unable to update immediately, administrative controls can be employed to restrict file import capabilities or monitor disk usage thresholds closely. Developers and security teams reviewing similar tools should enforce input validation that checks archive metadata for excessive entry counts before initiating extraction processes. Implementing rate limiting, quota enforcement at the application level, and thorough testing with malformed archives are essential practices to prevent resource exhaustion vulnerabilities in software that handles user-provided compressed data files.