An improper handling of highly compressed data in Ghidra’s ThemeReader.processIconFile() allows an attacker to craft a theme ZIP file whose icon entries, when extracted, consume an excessive amount of disk space. The lack of limits on decompressed size or compression ratio causes the application to attempt to write an expanded icon image that exceeds available storage, resulting in failed writes and a crash of the Ghidra interface.

The affected product is National Security Agency Ghidra, versions 10.3 through 12.1 inclusive. No specific sub‑versions are listed, so all builds prior to 12.2 are potentially vulnerable.

The CVSS score of 6.8 indicates a moderate impact. Attack requires user interaction to import the malicious theme, so the likelihood of exploitation depends on social engineering. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting it is not widely exploited at present. Organizations that use Ghidra in a shared or multi‑user environment should treat the risk as moderate pending an update.