CVE-2026-115395

MEDIUM 5.5

Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme archive with many small files, exhausting inodes and disk space to deny service to the host.

CWE	CWE-770
Vendor	nationalsecurityagency
Product	ghidra
Published	Oct 22, 2026

Stay Ahead of the Next One

Get instant alerts for nationalsecurityagency ghidra

Be the first to know when new medium vulnerabilities affecting nationalsecurityagency ghidra are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

NationalSecurityAgency / ghidra

10.3 < 12.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-fvwx-pwq5-3738 github.com: https://github.com/NationalSecurityAgency/ghidra/commit/b0762c3e728a6a26d80ed4943c2efd53e2569120 github.com: https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build github.com: https://github.com/NationalSecurityAgency/ghidra vulncheck.com: https://www.vulncheck.com/advisories/ghidra-10.3-before-12.2-denial-of-service-via-themereader-readziptheme

Credits

Yuvraj Saxena (0xXA)