Executive brief
Ghidra, a popular software reverse-engineering suite, is vulnerable to a denial-of-service attack when analyzing certain files. An attacker can create a specially crafted binary file containing malicious Rust code symbols that, when opened in Ghidra, causes the application to consume all available system memory and crash. This disrupts the analysis process and can lead to loss of unsaved work for security researchers and developers.
Technical details
An out-of-memory vulnerability exists in the `rust_demangle` function within Ghidra's GNU Demangler component (GPL/DemanglerGnu). The root cause is the `str_buf_reserve()` function, which performs exponential memory allocation for output buffers without implementing a maximum size limit. By crafting a malformed Rust v0 mangled symbol (as small as 61 bytes) with nested generic parameters, an attacker can trigger unbounded allocation exceeding 2GB. This occurs during the binary analysis phase when Ghidra attempts to demangle symbols for display. The issue is resolved in Ghidra 12.0.3, which introduces process timeouts and improved bounds checking for the demangler.
Affected products
- NSA Ghidra < 12.0.3
Timeline
- 2026-02-11: advisory: GitHub Security Advisory GHSA-m94m-fqr3-x442 published
- 2026-06-10: disclosed: CVE-2026-52753 published to NVD
- 2026-06-10: patched: Fix confirmed in version 12.0.3