Ghidra contains a resource allocation without limits vulnerability in FileSystemIndexHelper, which is used by TarFileSystem and ZipFileSystem. A crafted TAR or ZIP archive with excessive entries can cause the Java heap to be exhausted, resulting in a hung session. The flaw allows an attacker to trigger a denial of service by forcing a user to open or batch‑import such an archive. The weakness is categorized as CWE‑770, Resource Exhaustion.

All versions of Ghidra prior to 12.2 released by the National Security Agency. The vulnerability is present in any installation that can load or import TAR or ZIP archives through the affected file system classes. Users running earlier releases of Ghidra should verify their version and avoid causing the application to process large or malicious archives.

The CVSS score of 6.8 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need to persuade or trick a user into opening a specially crafted archive; the attack does not require remote code execution or privileged access. Once the archive is processed, Ghidra's Java process may become unresponsive, effectively denying service to the current user or to any batch import operations. Because the vulnerability relies on the user’s interaction with a file, it is considered a low-to-moderate likelihood of exploitation but can be catastrophic for environments that depend on continuous availability of Ghidra.