Ghidra versions before 12.2 include a vulnerability in ExtensionUtils.unzipToInstallationFolder() that performs unbounded extraction of ZIP entries during the installation of an extension. The weakness, classified as resource exhaustion, allows an attacker to supply a crafted extension archive containing an excessive number of files. When these files are extracted, the filesystem can run out of inodes, blocking new project writes and causing other dependent processes to fail. The impact is a service outage that can affect users performing normal extension installations.

The issue is observed in the National Security Agency’s Ghidra product, affecting all releases prior to 12.2. Users of any Ghidra distribution based on older code should treat the current version as vulnerable unless they have manually applied a protective patch or changed configuration to limit extraction.

The CVSS score of 6.8 indicates moderate severity, and no EPSS data or KEV listing is available, suggesting exploitation is not widely observed yet. The likely attack vector requires an attacker to convince a user to install a malicious extension archive, which is a social‑engineering or user‑facing vector. Once installed, the resource exhaustion can reduce availability of the entire Ghidra environment.