CVE-2026-52753: medium-severity vulnerability in nationalsecurityagency ghidra
Ghidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.7epss 0.2%
Ghidra before 12.0.3 contains an out-of-memory vulnerability in the rust_demangle function that allocates unbounded output buffers without size limits. Attackers can craft malicious Rust symbol names in binaries to trigger exponential memory allocation, causing process crashes during binary analysis.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
nationalsecurityagency · ghidraRelated CVEs — nationalsecurityagency ghidra
In the same product, most dangerous first.
CVE-2026-52751HIGHGhidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project ConnectionEPSS 0.7%CVE-2026-52750HIGHGhidra < 12.1- Command Injection via URL Annotation ClickEPSS 0.5%CVE-2026-52756MEDIUMGhidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF ServerEPSS 0.5%CVE-2026-52758HIGHGhidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim SearchEPSS 0.3%CVE-2026-49498HIGHGhidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped UsernameEPSS 0.3%CVE-2026-52754HIGHGhidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModuleEPSS 0.3%