CVE-2026-115396 in Ghidra
Summary
by MITRE • 10/22/2026
Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The Ghidra software suite, specifically versions prior to 12.2, contains a critical resource exhaustion vulnerability within its ThemeReader component. This flaw resides in the processIconFile method, which is responsible for parsing and loading icon files from theme archives during the importation of custom user interfaces. The core technical deficiency lies in the absence of safeguards against decompression bombs or zip bombs. When processing ZIP archive entries that contain highly compressed data, Ghidra fails to enforce limits on either the maximum decompressed size or the compression ratio. This oversight allows an attacker to craft a malicious theme file where small compressed payloads expand into massive amounts of uncompressed data when processed by the application logic.
From a technical perspective, this vulnerability is classified under CWE-409, which describes Improper Handling of Highly Compressed Data (Data Amplification). The attack vector relies on social engineering or supply chain compromise to persuade a user with appropriate privileges to import a specially crafted theme ZIP file into Ghidra. Upon execution, the application attempts to decompress these entries without verifying whether the resulting data volume exceeds available system resources. As the decompression proceeds, the memory and disk space consumption grows exponentially relative to the original file size. This behavior is consistent with patterns observed in ATT&CK technique T1496, Resource Hijacking, where an adversary consumes computational resources to degrade service availability or cause denial of conditions for legitimate operations.
The operational impact of this vulnerability extends beyond simple application instability. As the decompressed icon data expands, it rapidly fills available storage on the host filesystem and exhausts system memory. This resource depletion leads to subsequent write operations failing due to lack of space or out-of-memory errors. In a practical scenario, this can cause Ghidra to crash abruptly, potentially resulting in the loss of unsaved work such as reverse engineering projects or analysis notes. Furthermore, if the application attempts to continue operating under severe resource constraints, it may exhibit unpredictable behavior, including freezing or becoming unresponsive, thereby disrupting security research and development workflows that depend on stable tooling environments.
Mitigation strategies for this vulnerability primarily involve updating the Ghidra installation to version 12.2 or later, where developers have implemented proper bounds checking and size validation during the decompression process. Until an update is applied, users should exercise extreme caution when importing theme files from untrusted sources. It is advisable to validate archive contents using external tools that can detect compression ratios before loading them into Ghidra. Additionally, administrators may consider implementing file integrity monitoring or restricting the execution of unsigned scripts and plugins within the development environment to reduce the attack surface associated with arbitrary code execution or resource exhaustion via third-party extensions.