CVE-2026-115503 in Ghidra
Summary
by MITRE • 10/22/2026
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in versions of the Ghidra reverse engineering framework prior to release 12.2 represents a critical failure in input validation within the ExtensionUtils.unzipToInstallationFolder() method. This function is responsible for extracting extension archives into the application's directory structure, a process that inherently involves decompressing data provided by external sources. The core technical flaw lies in the absence of limits on the expansion ratio or total output size during the unzipping operation. When processing highly compressed files, such as those designed specifically to exploit this behavior known as zip bombs, the software fails to monitor the growth of uncompressed data against available disk space or predefined thresholds. This lack of safeguards allows an attacker to craft a malicious archive that appears small in its compressed form but expands into gigabytes or terabytes of data upon decompression, effectively bypassing any implicit assumptions about file size safety within the extraction routine.
From an operational perspective, this vulnerability enables a denial-of-service condition by exhausting available disk space on the victim's system. An attacker can distribute these crafted zip bomb extension archives through social engineering tactics, such as phishing emails or malicious forums posing as legitimate Ghidra extensions. Once a user installs the compromised archive, the extraction process runs unchecked, rapidly filling up storage partitions. This exhaustion of resources causes subsequent write operations by Ghidra itself to fail, rendering the tool unusable for its intended purpose. Furthermore, because disk space is shared across operating systems and applications, this resource depletion can impact other critical processes running on the same machine, leading to broader system instability or crashes in unrelated software that depends on available storage for temporary files or data persistence.
This vulnerability aligns with CWE-409, which describes Improper Handling of Highly Compressed Data (Data Amplification), a category of flaws where systems fail to account for the significant size increase inherent in decompression operations. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1486, Data Encrypted for Impact, although here the encryption aspect is replaced by compression-based resource exhaustion aimed at disrupting availability rather than encrypting data for ransom. The attack vector primarily relies on user interaction to initiate the installation of a malicious extension, classifying it as an input validation failure that exploits trust in file formats and installer mechanisms.
Mitigation strategies must focus on implementing strict limits within the extraction logic before or during the decompression process. Developers should enforce maximum allowed sizes for both compressed archives and their uncompressed counterparts, ensuring that any expansion exceeding these thresholds triggers a safe abort of the operation rather than continuing to write data to disk. Additionally, integrating real-time monitoring of available storage space can provide an additional layer of defense against resource exhaustion attacks. For users operating older versions of Ghidra, immediate upgrade to version 12.2 or later is essential as this release addresses the improper handling logic within ExtensionUtils. Until such updates are applied, administrators should restrict extension installation privileges and validate all incoming archive files using external tools that check for compression bombs before they interact with the application environment.