CVE-2026-115503

MediumCVSS 5.5/10Last modified Nov 5, 2026

Description

Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-409

Affected software

VendorProductVersions
NationalSecurityAgencyghidra< 12.2

References

Timeline

Published
Oct 22, 2026
Last modified
Nov 5, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1155047.8CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptoCVE-2026-1155057.6libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads CVE-2026-1155067.5libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparseCVE-2026-1155073.5Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolCVE-2026-1155086.5Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authentCVE-2026-1155094.2Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst withoCVE-2026-115519.8The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. ThiCVE-2026-1155138.7OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JCVE-2026-1155176.4Unrestricted network access between execution contexts in KNIME Business Hub before version 1.19.0 allows an authenticated remote user to acCVE-2026-1155192.1Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to comCVE-2026-115525.3A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System and Syllabus-aligned Learning Management andCVE-2026-1155225.3Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions