CVE-2026-52753

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-52753

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52753.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-52753

Aliases

GHSA-m94m-fqr3-x442

Published

2026-06-10T12:40:22.903Z

Modified

2026-07-16T03:48:36.766358645Z

Severity

6.7 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Ghidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol

Details

Ghidra before 12.0.3 contains an out-of-memory vulnerability in the rust_demangle function that allocates unbounded output buffers without size limits. Attackers can craft malicious Rust symbol names in binaries to trigger exponential memory allocation, causing process crashes during binary analysis.

Database specific

{
    "cwe_ids": [
        "CWE-789"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52753.json",
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/nationalsecurityagency/ghidra

Affected ranges

Type

GIT

Repo

https://github.com/nationalsecurityagency/ghidra

Events

Introduced

Fixed

09f14c92d3da6e5d5f6b7dea115409719db3cce1

Database specific

{
    "cpe": "cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "12.0.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

Ghidra_10.*

Ghidra_10.3_build

Ghidra_12.*

Ghidra_12.0.1_build

Ghidra_12.0.2_build

Ghidra_12.0_build

Ghidra_9.*

Ghidra_9.0.1_build

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52753.json"