Quick answers
- Is CVE-2026-115398 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-115398 being exploited in the wild.
- How severe is CVE-2026-115398?
- Medium severity, with a CVSS score of 5.5, published 22 October 2026.
- Which products and versions are affected?
- Nsa Ghidra before 12.2.
- Is there a fix for CVE-2026-115398?
- Yes: fixed in Ghidra 12.2. Until then: Avoid opening or importing TAR and ZIP archives from untrusted sources. If upgrading is not immediately possible, restrict archive import operations to files from verified sources only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-115398 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-115398?
- Check whether you run Nsa Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Ghidra 12.2
Avoid opening or importing TAR and ZIP archives from untrusted sources. If upgrading is not immediately possible, restrict archive import operations to files from verified sources only.
Technical details
The FileSystemIndexHelper class used by TarFileSystem and ZipFileSystem does not enforce a limit on the number of archive entries, leading to unbounded memory allocation. An attacker can craft a TAR or ZIP file with an excessive number of entries to exhaust the Java heap. The vulnerability requires user interaction (opening or batch-importing an archive) but allows denial of service via resource exhaustion.
Affected products
- NSA Ghidra before 12.2
Timeline
- 2026-10-22: disclosed