CVE-2026-115503
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that
CVSS
5.5
Medio
EPSS
0.1%
p2
KEV
—
Exploit Today
1
0-100
Publicado: 22 oct 2026 · Última mod.: 23 oct 2026 · CWE-409
Sin historial EPSS suficiente todavía.
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.
- github.comhttps://github.com/NationalSecurityAgency/ghidra
- github.comhttps://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784
- github.comhttps://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build
- github.comhttps://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mcjr-7qqr-m3w8
- www.vulncheck.comhttps://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-compressed-extension-archive
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1156384.3 MED10.9%
——3OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.17hCVE-2026-1153965.5 MED1.8%
——1Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.4hCVE-2026-1138737.5 ALT26.7%
——8SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.4hCVE-2026-93471—37.1%
——11Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.
esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.
This issue affects esaml: from 0.1.0 onward.1dCVE-2026-96637—25.4%
——8Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.2dCVE-2026-966366.5 MED19.5%
——6Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace self._size without rerunning Image._decompression_bomb_check(). A crafted multi-frame image can use a tiny first frame to pass Image.open() and then declare an over-limit later frame. Normal frame iteration through seek(), load(), or ImageSequence.Iterator can decode that frame and commit hundreds of megabytes or more, causing memory-exhaustion denial of service. This issue is fixed in version 13.0.0.2d