CVE-2026-115396: Improper Handling of Highly Compressed Data (Data Amplification) in NationalSecurityAgency ghidra

The National Security Agency's Ghidra software versions from 10.3 up to but not including 12.2 have an improper handling of highly compressed data vulnerability in the ThemeReader.processIconFile() method. The vulnerability arises because the software does not limit the decompressed size or compression ratio of icon entries within theme ZIP files. An attacker can craft a theme ZIP file whose icon entries decompress to an excessively large size, filling the host filesystem and causing failures in subsequent write operations. Exploitation requires persuading a user to import the malicious theme file. There are no known exploits in the wild, and the vulnerability has a CVSS 4.0 score of 6.8 (medium severity).

Successful exploitation can cause denial of service conditions by filling the host filesystem with decompressed data from crafted theme ZIP icon entries. This leads to failures in later write operations on the affected system. No direct code execution or privilege escalation is indicated. User interaction is required to trigger the vulnerability.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid importing untrusted or suspicious theme ZIP files into Ghidra versions 10.3 through 12.1.