CVE-2026-52757: falha de média gravidade em nationalsecurityagency ghidra
Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() during decompilation
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.6epss 0.1%
Ghidra before 12.1 contains a heap-use-after-free vulnerability in the decompiler's HighVariable::merge() function during the variable merging pass. Attackers can trigger this vulnerability by crafting a binary that causes stale pointers in the HighIntersectTest::highedgemap cache to be dereferenced, reading and writing the flags field of freed heap memory when a user opens the binary in Ghidra's decompiler view.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
nationalsecurityagency · ghidraCVEs relacionadas — nationalsecurityagency ghidra
No mesmo produto, das mais perigosas para as menos.
CVE-2026-52751HIGHGhidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project ConnectionEPSS 0.7%CVE-2026-52750HIGHGhidra < 12.1- Command Injection via URL Annotation ClickEPSS 0.5%CVE-2026-52756MEDIUMGhidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF ServerEPSS 0.5%CVE-2026-52758HIGHGhidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim SearchEPSS 0.3%CVE-2026-49498HIGHGhidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped UsernameEPSS 0.3%CVE-2026-52754HIGHGhidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModuleEPSS 0.3%