CVE-2026-115396 Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive

What is CVE-2026-115396?

CVE-2026-115396 is a medium-severity vulnerability in NationalSecurityAgency ghidra, published on 22 Oct 2026.

Official description

Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.

Weakness: CWE-409

Which versions are affected by CVE-2026-115396?

It affects 1 product.

Products include Nsa Ghidra.

How do I fix CVE-2026-115396?

No fix has been published for CVE-2026-115396 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-115396 being exploited?

There is no known exploitation of CVE-2026-115396 in the wild and no public exploit code.

Other vulnerabilities in NationalSecurityAgency ghidra

• CVE-2023-22671 Command injection in n/a Critical 9.8
• CVE-2019-16941 XML external entity in n/a Critical 9.8
• CVE-2019-13625 XML external entity in n/a Critical 9.1
• CVE-2026-4946 NSA Ghidra Auto-Analysis Annotation Command Execution High 8.8
• CVE-2026-49498 Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-6mj8-x8x9-7gxq, GHSA-fr5c-6rcj-3fw2.