CVE-2026-115394

mediumpriority · track · 22

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

CVSS 5.5 · medium

Is it mine?

0 products

Check your exposure

Who says so?

— sources

Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit length field. Attackers can persuade users to import a crafted GZF packed database file, triggering an OutOfMemoryError in PackedDatabase.open() that aborts the import and denies service.

cvss

Technical severity, 0–10. One row per scoring source.

6.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:Hprimary · disclosure@vulncheck.comexploitability 1.8 · impact 3.6

v4.06.8mediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · disclosure@vulncheck.com

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-789USprimaryCWE-789US

affected products

Products and version ranges known to be affected.

No affected products recorded.

sources

Which sources assert this record, and when.

NVD CVE.org MITRE

published 2026-10-22modified 2026-10-22

related (374)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2022-30522US	high7.5	89.5% (100th)	—	2022-06-09
If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory al…
CVE-2025-27533US	high7.5	8.96% (95th)	Exploit	2025-05-07
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which…
CVE-2017-7651US	high7.5	5.12% (92nd)	Exploit	2018-04-24
In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can be done without authen…
CVE-2012-2794US	high10.0	3.20% (88th)	—	2012-09-10
Unspecified vulnerability in the decode_mb_info function in libavcodec/indeo5.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and a…
CVE-2003-1092US	high7.5	3.65% (90th)	Exploit	2003-12-31
Unknown vulnerability in the "Automatic File Content Type Recognition (AFCTR) Tool version of the file package before 3.41, related to "a memory allocation problem," has unknown im…

+369 more

references (5) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan