Ghidra CVE-2026-115394

Exploitation requires a user (or an automated headless Ghidra instance) to import a crafted GZF packed database file through the GzfLoader import path; the malicious file must contain a DB BinaryField record whose 32-bit length field is set to an arbitrarily large value. Triggering factors that LIMIT exploitation: passive user interaction is required (UI:P) - the victim must be persuaded to import the attacker-supplied file, and the vector is local (AV:L), so there is no remote unauthenticated network exposure. No authentication or privileges are needed (PR:N). Impact is confined to availability (process crash and loss of unsaved work); the condition that most amplifies real risk is deployment in automated binary-analysis/triage pipelines using headless Ghidra, where a single malicious sample crashes the processing queue. All versions through 12.2 are affected; the fix is upgrading to 12.2.

This is a medium-severity, availability-only denial-of-service issue, not a high-impact priority. The vendor CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 6.8 and confirms the shape: local attack vector, low complexity, no privileges (PR:N), but passive user interaction required (UI:P), and impact limited strictly to availability (VC:N/VI:N/VA:H) - there is no confidentiality or integrity loss. Exploitation status is 'no public exploit identified at time of analysis' (no CISA KEV listing and no input field confirming public exploit code), though the GHSA advisory publishes the exact triggering mechanism, source lines, and a full OutOfMemoryError stack trace, which materially lowers the barrier to reproducing it. The vuln.today decision label is 'this_month' rather than act_now/emergency, consistent with a DoS that requires user action. EPSS is not provided in the input, so exploitation probability cannot be quantified here. Note a data conflict: the input Tags label this 'Information Disclosure', but every signal (CWE-789 uncontrolled allocation, VC:N/VI:N, VA:H, description, and advisory) establishes it as availability-only denial of service - the tag is wrong. Realistic risk is elevated specifically for automated/headless Ghidra triage pipelines where a single malicious sample can crash the processing queue; for interactive analysts the consequence is a crashed session and loss of unsaved work.

An adversary distributing malware embeds a crafted GZF packed database file whose BinaryField record encodes an arbitrarily large 32-bit length value. An analyst (or an automated headless pipeline) imports the file; PackedDatabase.open() parses the record and DataBuffer.get() attempts to allocate a byte array of the attacker-chosen size, immediately triggering a Java heap OutOfMemoryError that aborts the import and crashes the Ghidra JVM. No public exploit code is identified at time of analysis, but the GHSA advisory publishes the full trigger mechanism and stack trace.