PT-2026-48417 · Ghidra · Ghidra

CVE-2026-52757 · Published 2026-06-10 · Updated 2026-06-12

Positive Technologies (AI Summary)

CVSS v4.0

4.6

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ghidra versions prior to 12.1

Description A heap-use-after-free issue exists in the decompiler's HighVariable::merge() function during the variable merging pass. This occurs when a user opens a specially crafted binary in the decompiler view, causing stale pointers in the HighIntersectTest::highedgemap cache to be dereferenced. This allows for reading and writing the flags field of freed heap memory.

Recommendations Update to version 12.1 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-52757

GHSA-8JQP-QV73-395R

Affected Products

Ghidra

References · 9

• 🔥 https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-8jqp-qv73-395r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52757.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-52757 · Security Note
• https://osv.dev/vulnerability/CVE-2026-52757 · Vendor Advisory
• https://github.com/nationalsecurityagency/ghidra · Note
• https://vulncheck.com/advisories/ghidra-heap-use-after-free-in-highvariable-merge-during-decompilation · Note
• https://t.me/CVEtracker/56451 · Telegram Post
• https://twitter.com/CVEnew/status/2064709806665994344 · Twitter Post
• https://t.me/cveNotify/167156 · Telegram Post