# CVE-2026-115398: NSA Ghidra resource exhaustion in archive parsing

Source: https://junglewise.ai/threats/cve-2026-115398-ghidra-before-12-2-contains-a-resource-allocation-without-limits  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-115398 · Severity: medium · CVSS 5.5 · Published 2026-10-22

Ghidra is a software reverse engineering framework used by security analysts to analyze malware and binaries. Before version 12.2, it fails to limit the number of entries when importing TAR or ZIP archives, allowing an attacker to craft a malicious archive that exhausts system memory and freezes the application when opened or imported. Users who open untrusted archives may experience denial of service.

Technologies: [Nsa Ghidra](https://junglewise.ai/threats/technologies/nsa-ghidra). Vendors: [Nsa](https://junglewise.ai/threats/vendors/nsa).

## Quick answers

**Is CVE-2026-115398 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115398 being exploited in the wild.

**How severe is CVE-2026-115398?** Medium severity, with a CVSS score of 5.5, published 22 October 2026.

**Which products and versions are affected?** Nsa Ghidra before 12.2.

**Is there a fix for CVE-2026-115398?** Yes: fixed in Ghidra 12.2. Until then: Avoid opening or importing TAR and ZIP archives from untrusted sources. If upgrading is not immediately possible, restrict archive import operations to files from verified sources only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115398 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-115398?** Check whether you run Nsa Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Ghidra 12.2

Avoid opening or importing TAR and ZIP archives from untrusted sources. If upgrading is not immediately possible, restrict archive import operations to files from verified sources only.

## Technical details

The FileSystemIndexHelper class used by TarFileSystem and ZipFileSystem does not enforce a limit on the number of archive entries, leading to unbounded memory allocation. An attacker can craft a TAR or ZIP file with an excessive number of entries to exhaust the Java heap. The vulnerability requires user interaction (opening or batch-importing an archive) but allows denial of service via resource exhaustion.

## Affected products

- NSA Ghidra before 12.2

## Timeline

- 2026-10-22: disclosed

## References

- [https://github.com/NationalSecurityAgency/ghidra](https://github.com/NationalSecurityAgency/ghidra)
- [https://github.com/NationalSecurityAgency/ghidra/commit/061ec06a79f4147267f6fc690b0dcf944b2d4957](https://github.com/NationalSecurityAgency/ghidra/commit/061ec06a79f4147267f6fc690b0dcf944b2d4957)

## Related threats

- [NSA Ghidra uncontrolled memory allocation in BinaryField.read()](https://junglewise.ai/threats/cve-2026-115394-ghidra-through-12-2-contains-an-uncontrolled-memory-allocation)
- [NSA Ghidra ELF loader denial of service via unvalidated header counts](https://junglewise.ai/threats/cve-2026-113604-ghidra-10-2-through-12-1-4-contains-a-denial-of-service)