What’s Vulnerable › Vulnerabilities

CVE-2026-52759: Ghidra < 12.1.1 - Denial of Service via Uncontrolled Memory Allocation in Mach-O Parser

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-10 · updated 2026-06-17
• Weakness: CWE-789

Description

Ghidra before 12.1.1 contains an uncontrolled memory allocation vulnerability in the Mach-O binary parser that allows attackers to cause denial of service. An attacker can supply a crafted Mach-O binary with an arbitrarily large ncmds load command count value, forcing the parser to allocate excessive heap memory without validating file size, crashing the Ghidra JVM.

Affected products

• nationalsecurityagency ghidra: before 12.1.1 — fixed in 12.1.1

How to fix

Upgrade to a fixed version: nationalsecurityagency ghidra 12.1.1. Check the vendor advisory for mitigations.

References

• https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v6c3-h9cp-3whf
• https://www.vulncheck.com/advisories/ghidra-denial-of-service-via-uncontrolled-memory-allocation-in-mach-o-parser
• https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v6c3-h9cp-3whf

Get alerted when CVE-2026-52759 or the next vulnerability affects your stack