The vulnerability lies in Ghidra’s ExtensionUtils.unzipToInstallationFolder() routine, which fails to limit the size of highly compressed data. A crafted zip‑bomb extension expands beyond normal limits, consuming large amounts of disk space. Once disk space is exhausted, Ghidra and other applications that attempt to write to the filesystem will fail, leading to a denial of service.

The affected product is Ghidra from the National Security Agency, any release prior to 12.2. Users relying on Ghidra for reverse engineering and who install third‑party extensions are at risk.

The CVSS score of 6.8 indicates a moderate severity due to the resource exhaustion attack. Although the EPSS score is not available, the risk is mitigated by the fact that the attacker must supply a malicious extension archive, typically through user action or a compromised extension source. Once the archive is unpacked, disk space is drained, disabling subsequent writes for Ghidra and other processes. The vulnerability is not listed in CISA KEV, but the potential impact remains significant.