Ghidra versions before 12.2 have a vulnerability in the ExtensionUtils.unzipToInstallationFolder() function that improperly handles highly compressed data. This flaw allows attackers to craft zip bomb extension archives that expand without size limits, potentially exhausting disk space. This can cause failures in subsequent writes by Ghidra and other applications. The vulnerability requires user interaction to install a malicious extension archive.
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.
Ghidra versions before 12.2 have a vulnerability in the ExtensionUtils.unzipToInstallationFolder() function where ZIP entries are extracted without limiting the number of files. This can lead to exhaustion of filesystem inodes if a user installs a maliciously crafted extension archive containing many files, causing failures in project writes and other processes.
Ghidra versions 10.3 up to but not including 12.2 contain a vulnerability in the ThemeReader.processIconFile() function where highly compressed data is improperly handled. This flaw allows crafted theme ZIP files with icon entries that decompress to very large sizes, potentially filling the host filesystem and causing subsequent write operations to fail. The vulnerability requires user interaction to import the malicious theme file. The CVSS 4.0 base score is 6.8, indicating a medium severity level.
Ghidra versions 10.3 up to but not including 12.2 have a vulnerability in the ThemeReader.readZipTheme() function where importing a crafted theme ZIP archive with many small files can exhaust disk inodes and space, causing a denial of service. This occurs due to resource allocation without limits or throttling during theme extraction. The vulnerability requires user interaction to import the malicious theme archive.
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application's credentials. This may result in key management operations being performed with parameters the application did not intend.
Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit length field. Attackers can persuade users to import a crafted GZF packed database file, triggering an OutOfMemoryError in PackedDatabase.open() that aborts the import and denies service.
A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire representation, producing binary elements that misdeclare their type or length. An unauthenticated party able to supply text parsed by an affected application can cause it to emit and persist malformed binary data, which subsequent readers either reject with an error or silently interpret as shorter than the data that was validated.
CVE-2026-115393 is a type confusion vulnerability in the bytecodealliance wasmtime project affecting multiple version ranges before specific fixed releases. The flaw arises because certain Store APIs do not validate that objects belong to the Store's Engine, allowing embedders to mix objects between Engines. This can cause trampoline signature mismatches leading to out-of-bounds stack writes, garbage collector heap corruption, or panics.
CVE-2026-115392 is a high-severity vulnerability in the bytecodealliance wasmtime runtime affecting multiple version ranges before specific fixed releases. It allows a filesystem sandbox escape via mishandling of symbolic links with trailing slashes on macOS and Linux kernels lacking openat2 support. This flaw enables a guest with write access to any sandboxed directory to read and write any host-accessible file, and read-only guests to read host files through preexisting symlinks.
A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the stored data — without possession of the encryption keys — can observe the unprotected values.
Wasmtime versions 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contain a vulnerability in the WASIp3 implementation where guest-specified-length writes are buffered without limits. This can lead to excessive memory consumption on the host system, potentially exhausting host memory resources.
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the application passes into the affected builder surface, without any special privilege beyond ordinary read-write application access, may cause stored data to be modified or removed in ways the application never intended. The result is unauthorized integrity impact on the affected application data; there is no direct loss of confidentiality or availability of the database service.
A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps certain primitive collection types can cause residual bytes from unrelated data processed earlier on the same execution thread to be surfaced as legitimate values. This can result in disclosure of a limited amount of information belonging to other requests or principals of the consuming application. No authentication or special privileges within the application are required.
Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.
CVE-2026-115389 is a resource allocation vulnerability in bytecodealliance's wasmtime affecting versions before 36.0.16, between 37.0.0 and before 48.0.3, and between 49.0.0 and before 49.0.1. The issue arises because wasmtime does not properly account for host memory allocations when lifting guest values via the Val API, allowing a malicious WebAssembly guest to allocate significantly more host memory than tracked. This can lead to denial of service due to resource exhaustion. The vulnerability has a low severity rating and no known exploits in the wild. No patch links are provided in the input data.
A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer fails to associate the operation with its configured encryption rules and the operation proceeds without an error being raised. An application user with the ability to write data through an affected application can therefore have sensitive fields persisted in plaintext, defeating the confidentiality guarantee that client-side encryption is intended to provide. No integrity or availability impact was observed.
CVE-2026-115388 is a vulnerability in the wasmtime-wasi-http component of Wasmtime that allows uncontrolled resource consumption. Versions before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 do not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies. This flaw permits a malicious guest to write oversized buffers to outgoing HTTP body resources, causing host memory exhaustion by holding allocations for the store's lifetime.
The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.
CVE-2026-115387 is a denial of service vulnerability in bytecodealliance's wasmtime-wasi component. It affects multiple version ranges of wasmtime before specific fixed versions. The flaw allows guest WASI programs to cause the host to panic by passing filesystem timestamp values with overflowing sub-second fields, leading to a crash.