CVE-2026-52753

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-52753
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52753.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-52753
Aliases
  • GHSA-m94m-fqr3-x442
Published
2026-06-10T12:40:22Z
Modified
2026-08-12T16:25:42Z
Severity
  • 6.7 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Ghidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol
Details

Ghidra before 12.0.3 contains an out-of-memory vulnerability in the rust_demangle function that allocates unbounded output buffers without size limits. Attackers can craft malicious Rust symbol names in binaries to trigger exponential memory allocation, causing process crashes during binary analysis.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-789"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52753.json"
}
References

Affected packages

Git / github.com/nationalsecurityagency/ghidra

Affected ranges

Type
GIT
Repo
https://github.com/nationalsecurityagency/ghidra
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
09f14c92d3da6e5d5f6b7dea115409719db3cce1
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "12.0.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

Ghidra_10.*
Ghidra_10.3_build
Ghidra_12.*
Ghidra_12.0.1_build
Ghidra_12.0.2_build
Ghidra_12.0_build
Ghidra_9.*
Ghidra_9.0.1_build

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52753.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "14452560219353461874682079616675760102",
                "241878227154669002884272489390380470983",
                "218711909065982768287021434254879024722",
                "38661557862576582862024771976370105508",
                "210494956023312644073447038487532306819",
                "26950389001681389779894752331159027220",
                "44134878735772219776368491806952433447",
                "16796979239897166686115193572286690222"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-52753-18a71f2c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/nationalsecurityagency/ghidra/commit/09f14c92d3da6e5d5f6b7dea115409719db3cce1",
        "target": {
            "file": "Ghidra/Test/IntegrationTest/src/test.slow/java/ghidra/server/remote/ServerTestUtil.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "155739949213535221348782618684453007072",
            "length": 1444
        },
        "id": "CVE-2026-52753-7e1d5bb7",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/nationalsecurityagency/ghidra/commit/09f14c92d3da6e5d5f6b7dea115409719db3cce1",
        "target": {
            "file": "Ghidra/Test/IntegrationTest/src/test.slow/java/ghidra/server/remote/ServerTestUtil.java",
            "function": "generatePkiCerts"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T16:25:42Z"