CVE-2026-115398: Allocation of Resources Without Limits or Throttling in NationalSecurityAgency ghidra
Description
Ghidra versions before 12.2 have a vulnerability in the FileSystemIndexHelper component used by TarFileSystem and ZipFileSystem. This flaw allows attackers to craft TAR or ZIP archives with excessive entries that can exhaust the Java heap memory when opened or batch-imported, causing the application session to hang.
CVSS v4.0
Score 6.8medium
Affected software
NationalSecurityAgency
ghidra
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-115398 describes a resource allocation without limits or throttling vulnerability in NationalSecurityAgency's Ghidra software prior to version 12.2. The vulnerability exists in the FileSystemIndexHelper, which is utilized by the TarFileSystem and ZipFileSystem modules. These modules store archive entries without bounding their number, allowing an attacker to create a malicious TAR or ZIP archive containing an excessive number of entries. When a user opens or batch-imports such an archive, the Java heap memory can be exhausted, resulting in the application hanging.
Potential Impact
Successful exploitation leads to denial of service by exhausting Java heap memory, causing the Ghidra session to hang. There is no indication of privilege escalation, code execution, or data corruption. The attack requires user interaction (opening or importing a crafted archive).
Mitigation Recommendations
No official patch or fix information is provided in the available data. Users should avoid opening or batch-importing untrusted TAR or ZIP archives with potentially excessive entries until an official fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-22T11:27:18.002Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ada649d4d27ba8daa755e31
Added to database: 10/22/2026, 19:31:41 UTC
Last enriched: 10/22/2026, 21:00:38 UTC
Last updated: 10/22/2026, 21:00:38 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.