Ghidra versions prior to 12.2 contain a resource allocation flaw in ThemeReader.readZipTheme() that allows the extraction of an unlimited number of entries from a theme ZIP archive into the images directory. This can lead to exhaustion of inodes and disk space, thereby disabling further operations on the affected host. The weakness is classified as CWE-770, Resource Exhaustion.

The vulnerability affects the National Security Agency’s Ghidra software. Defendants affected by Ghidra 10.3 and any earlier releases before the 12.2 build are at risk, irrespective of the operating system used for running Ghidra.

The CVSS score of 6.8 indicates a medium severity potential. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation evidence to date. Attackers can exploit the flaw by supplying a maliciously crafted theme archive to an unsuspecting user; the attacker requires the ability to persuade the user to import the theme. The exploit path does not require elevated privileges beyond the user running Ghidra, but the impact can affect the entire system if disk resources are exhausted.