CVE-2026-115503: Improper Handling of Highly Compressed Data (Data Amplification) in NationalSecurityAgency ghidra

CVE-2026-115503 describes an improper handling of highly compressed data vulnerability in NationalSecurityAgency's Ghidra software prior to version 12.2. The issue exists in the ExtensionUtils.unzipToInstallationFolder() method, which does not limit the expansion size of compressed archives. Attackers can exploit this by persuading users to install a crafted zip bomb extension archive that decompresses to an unbounded size, exhausting disk space and causing write failures in Ghidra and potentially other applications on the system.

Successful exploitation can lead to exhaustion of disk space on the victim's system, causing failures in file writes by Ghidra and other applications. This may disrupt normal operation and potentially cause denial of service conditions related to storage availability. No direct code execution or privilege escalation is indicated. The attack requires user interaction to install the malicious extension.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid installing untrusted or suspicious extension archives in Ghidra, especially those that could be highly compressed. Monitoring disk usage and limiting installation of extensions from unverified sources can reduce risk.