CVE-2026-115503

Name of the Vulnerable Software and Affected Versions Ghidra versions prior to 12.2

Description Improper handling of highly compressed data in the unzipToInstallationFolder() function allows attackers to exhaust disk space. This occurs when users are persuaded to install a crafted zip bomb extension archive that expands without size limits, leading to write failures for Ghidra and other applications. A zip bomb is a malicious archive file designed to crash or freeze the system by expanding to an enormous size when uncompressed.

Recommendations Update to version 12.2. As a temporary workaround, restrict the installation of extension archives from untrusted sources.