PT-2026-48419 · Ghidra · Ghidra

Kwenma · Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-52759

Mitre

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Ghidra before 12.1.1 contains an uncontrolled memory allocation vulnerability in the Mach-O binary parser that allows attackers to cause denial of service. An attacker can supply a crafted Mach-O binary with an arbitrarily large ncmds load command count value, forcing the parser to allocate excessive heap memory without validating file size, crashing the Ghidra JVM.

Fix

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-52759

Affected Products

Ghidra

References · 3

• https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v6c3-h9cp-3whf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-52759 · Security Note
• https://vulncheck.com/advisories/ghidra-denial-of-service-via-uncontrolled-memory-allocation-in-mach-o-parser · Note