Veille CVE

Octobre 2026

8 CVE

Critique 0 Élevée 0 Moyenne 7 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « NationalSecurityAgency ghidra » ✕
  1. CVE-2026-116012 3.6 Faible

    NationalSecurityAgency ghidra

    Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.

  2. CVE-2026-115503 5.5 Moyenne

    NationalSecurityAgency ghidra

    Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.

  3. CVE-2026-115398 5.5 Moyenne

    NationalSecurityAgency ghidra

    Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.

  4. CVE-2026-115397 5.5 Moyenne

    NationalSecurityAgency ghidra

    Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a crafted extension archive with many files can exhaust filesystem inodes, causing project writes and other processes to fail.

  5. CVE-2026-115396 5.5 Moyenne

    NationalSecurityAgency ghidra

    Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.

  6. CVE-2026-115395 5.5 Moyenne

    NationalSecurityAgency ghidra

    Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme archive with many small files, exhausting inodes and disk space to deny service to the host.

  7. CVE-2026-115394 5.5 Moyenne

    NationalSecurityAgency ghidra

    Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit length field. Attackers can persuade users to import a crafted GZF packed database file, triggering an OutOfMemoryError in PackedDatabase.open() that aborts the import and denies service.

  8. CVE-2026-113604 5.5 Moyenne

    NationalSecurityAgency ghidra

    Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec discovery at import or in headless analysis pipelines.