Is CVE-2026-52753 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52753 being exploited in the wild.

How severe is CVE-2026-52753?

Medium severity, with a CVSS score of 5.5, published 10 June 2026.

Is there a fix for CVE-2026-52753?

A patch was published on 2026-06-10: Fix confirmed in version 12.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52753 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-52753?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52753: NSA Ghidra out-of-memory vulnerability in Rust demangler

CVE-2026-52753 · Severity: medium · CVSS 5.5 · Published 2026-06-10

Ghidra, a popular software reverse-engineering suite, is vulnerable to a denial-of-service attack when analyzing certain files. An attacker can create a specially crafted binary file containing malicious Rust code symbols that, when opened in Ghidra, causes the application to consume all available system memory and crash. This disrupts the analysis process and can lead to loss of unsaved work for security researchers and developers.

Quick answers

Is CVE-2026-52753 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52753 being exploited in the wild.
How severe is CVE-2026-52753?: Medium severity, with a CVSS score of 5.5, published 10 June 2026.
Which products and versions are affected?: NSA Ghidra < 12.0.3.
Is there a fix for CVE-2026-52753?: A patch was published on 2026-06-10: Fix confirmed in version 12.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52753 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-52753?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-memory vulnerability exists in the `rust_demangle` function within Ghidra's GNU Demangler component (GPL/DemanglerGnu). The root cause is the `str_buf_reserve()` function, which performs exponential memory allocation for output buffers without implementing a maximum size limit. By crafting a malformed Rust v0 mangled symbol (as small as 61 bytes) with nested generic parameters, an attacker can trigger unbounded allocation exceeding 2GB. This occurs during the binary analysis phase when Ghidra attempts to demangle symbols for display. The issue is resolved in Ghidra 12.0.3, which introduces process timeouts and improved bounds checking for the demangler.

Affected products

NSA Ghidra < 12.0.3

Timeline

2026-02-11: advisory: GitHub Security Advisory GHSA-m94m-fqr3-x442 published
2026-06-10: disclosed: CVE-2026-52753 published to NVD
2026-06-10: patched: Fix confirmed in version 12.0.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.