Ghidra CVE-2026-115503

Exploitation requires a victim to manually install an attacker-supplied Ghidra extension ZIP archive through Ghidra's extension installer (File > Install Extensions), which invokes ExtensionUtils.unzipToInstallationFolder() to extract entries into ~/.config/ghidra/Ghidra*/Extensions with no cap on decompressed entry size, per-file size, or compression ratio. The required condition is therefore social engineering: the user must be persuaded to download and install the crafted zip-bomb archive. Limiting factors that reduce realistic risk: the attack is local (AV:L) and demands active user interaction (UI:P) - there is no remote or unauthenticated trigger - and impact is confined to availability (disk/CPU/I/O exhaustion causing a denial of service for Ghidra and other host applications), with no confidentiality or integrity consequence. Affected: all Ghidra versions before 12.2; fixed in 12.2.

This is a medium-severity, availability-only denial-of-service issue, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) correctly reflects a local, user-interaction-dependent flaw with impact limited to availability (VA:H) and zero confidentiality or integrity impact - so despite the 'Ghidra' being a high-profile NSA tool, this is not a remote code execution or data-exposure problem. No EPSS score, no CISA KEV listing, and no public exploit were supplied in the input, so there is no indication of active exploitation; the only exploitation driver is the attacker's ability to socially-engineer a user into installing a malicious extension. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with the absence of KEV and the user-interaction requirement. Net assessment: a real but non-urgent, self-inflicted-via-social-engineering DoS - patch on a normal maintenance cycle rather than as an emergency. Note one input inconsistency to verify: the Tags include 'Information Disclosure', but every authoritative source (GHSA advisory, CWE-409, CVSS VA:H with VC:N/VI:N) describes a disk-exhaustion denial of service with no disclosure - treat the 'Information Disclosure' tag as mislabeled.

An attacker publishes or distributes a Ghidra extension ZIP that contains a highly compressed entry (a zip bomb) whose decompressed size is effectively unbounded, then persuades a reverse-engineer to download and install it via Ghidra's extension installer. When Ghidra calls ExtensionUtils.unzipToInstallationFolder() the entry is written out without any size limit, filling the host partition to 100% as shown in the advisory's df output and stack trace. No public exploit was identified in the provided data, but the GHSA advisory includes a reproducing stack trace; exploitation is local and requires the victim to actively install the archive.