Vulnerability · Published Jun 10, 2026 · Assigned by VulnCheck
CVE-2026-52753Ghidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol
Medium 5.5
In plain English
A medium-severity security flaw in ghidra from nationalsecurityagency. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 95.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Ghidra before 12.0.3 contains an out-of-memory vulnerability in the rust_demangle function that allocates unbounded output buffers without size limits. Attackers can craft malicious Rust symbol names in binaries to trigger exponential memory allocation, causing process crashes during binary analysis.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nationalsecurityagency | ghidra | 0 – before 12.0.3 |
Weakness: CWE-789 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H