CVE-2026-115503: NationalSecurityAgency ghidra, отказ на услуга

Описание

Оригинално описание

Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.

Засегнати продукти

• NationalSecurityAgency ghidra: преди 12.2

Вид слабост

• CWE-409 Неправилна обработка на силно компресирани данни (усилване на данни)

История

Други уязвимости в NationalSecurityAgency ghidra

• 3.6CVE-2026-116012
• 6.8CVE-2026-115398
• 6.8CVE-2026-115397
• 6.8CVE-2026-115396
• 6.8CVE-2026-115394

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-115503
• https://nvd.nist.gov/vuln/detail/CVE-2026-115503
• https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mcjr-7qqr-m3w8
• https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784
• https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build
• https://github.com/NationalSecurityAgency/ghidra
• https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-compressed-extension-archive