CVE-2026-115397: Allocation of Resources Without Limits or Throttling in NationalSecurityAgency ghidra

CVE-2026-115397 describes a resource allocation vulnerability in NationalSecurityAgency's Ghidra software prior to version 12.2. The issue occurs in the ExtensionUtils.unzipToInstallationFolder() method, which extracts all files from an extension ZIP archive without imposing limits on the number of files extracted. An attacker who convinces a user to install a specially crafted extension archive with a large number of files can exhaust filesystem inodes, resulting in failures when writing projects or performing other filesystem operations.

The vulnerability can cause denial of service conditions on the affected system by exhausting filesystem inodes, which prevents successful project writes and may disrupt other processes relying on filesystem resources. There is no indication of privilege escalation or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid installing untrusted or suspicious extension archives to prevent inode exhaustion.