CVE-2026-115503

Publié : 22 octobre 2026

Modifié : 22 octobre 2026

Score CVSS

5.5

MEDIUM

Description détaillée

Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Références et Patchs

https://github.com/NationalSecurityAgency/ghidra https://github.com/NationalSecurityAgency/ghidra/commit/2c2bc5be182d655c9df418ac35b9782f39b6a784 https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mcjr-7qqr-m3w8 https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-compressed-extension-archive

Dernières Vulnérabilités

CVE-2026-97785

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

VOIR DÉTAILS

CVE-2026-96616

Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.

VOIR DÉTAILS

CVE-2026-96185

Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.

VOIR DÉTAILS