Vulnerability Description
Ghidra before 12.0.3 contains an out-of-memory vulnerability in the rust_demangle function that allocates unbounded output buffers without size limits. Attackers can craft malicious Rust symbol names in binaries to trigger exponential memory allocation, causing process crashes during binary analysis.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nsa | Ghidra | < 12.0.3 |
Related Weaknesses (CWE)
References
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-m94m-fExploitVendor Advisory
- https://www.vulncheck.com/advisories/ghidra-out-of-memory-in-rust-symbol-demanglThird Party Advisory
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-m94m-fExploitVendor Advisory
FAQ
What is CVE-2026-52753?
CVE-2026-52753 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Ghidra before 12.0.3 contains an out-of-memory vulnerability in the rust_demangle function that allocates unbounded output buffers without size limits. Attackers can craft malicious Rust symbol names ...
How severe is CVE-2026-52753?
CVE-2026-52753 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-52753?
Check the references section above for vendor advisories and patch information. Affected products include: Nsa Ghidra.