What’s Vulnerable › Vulnerabilities

CVE-2026-52753: Ghidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-10 · updated 2026-10-26
• Weakness: CWE-789

Description

Ghidra before 12.0.3 contains an out-of-memory vulnerability in the rust_demangle function that allocates unbounded output buffers without size limits. Attackers can craft malicious Rust symbol names in binaries to trigger exponential memory allocation, causing process crashes during binary analysis.

Affected products

• nationalsecurityagency ghidra: before 12.0.3 — fixed in 12.0.3

How to fix

Upgrade to a fixed version: nationalsecurityagency ghidra 12.0.3. Check the vendor advisory for mitigations.

References

• https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-m94m-fqr3-x442
• https://www.vulncheck.com/advisories/ghidra-out-of-memory-in-rust-symbol-demangler-via-malformed-symbol
• https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-m94m-fqr3-x442

Get alerted when CVE-2026-52753 or the next vulnerability affects your stack