CVE-2026-115398 — Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive en…
Published: 2026-10-22 · CVSS: 6.8 · CVSS 4.0
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7