PT-2026-48413 · U.S. National Security Agency · Ghidra

Ze Sheng · Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-52753

Mitre

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Ghidra before 12.0.3 contains an out-of-memory vulnerability in the rust demangle function that allocates unbounded output buffers without size limits. Attackers can craft malicious Rust symbol names in binaries to trigger exponential memory allocation, causing process crashes during binary analysis.

Fix

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-52753

Affected Products

Ghidra

References · 3

• https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-m94m-fqr3-x442 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-52753 · Security Note
• https://vulncheck.com/advisories/ghidra-out-of-memory-in-rust-symbol-demangler-via-malformed-symbol · Note