CVE-2026-115398

MEDIUM 5.5

Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.

CWE	CWE-770
Vendor	nationalsecurityagency
Product	ghidra
Published	Oct 22, 2026

Stay Ahead of the Next One

Get instant alerts for nationalsecurityagency ghidra

Be the first to know when new medium vulnerabilities affecting nationalsecurityagency ghidra are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

NationalSecurityAgency / ghidra

0 < 12.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vvp8-22p8-x954 github.com: https://github.com/NationalSecurityAgency/ghidra/commit/061ec06a79f4147267f6fc690b0dcf944b2d4957 github.com: https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build github.com: https://github.com/NationalSecurityAgency/ghidra vulncheck.com: https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-tar-and-zip-file-system-mount

Credits

Yuvraj Saxena (0xXA)