# CVE-2026-52757: NSA Ghidra heap use-after-free in decompiler HighVariable::merge

Source: https://junglewise.ai/threats/cve-2026-52757-nsa-ghidra-heap-use-after-free-in-decompiler-highvariable-merge  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-52757 · Severity: medium · CVSS 4.4 · Published 2026-06-10

Ghidra is a popular reverse-engineering tool used by security researchers to analyze software. A vulnerability in its decompiler component allows an attacker to craft a malicious binary file that, when opened by a user, causes the application to access memory it has already released. This can lead to application crashes, incorrect analysis results, or potentially more severe security compromises of the researcher's workstation.

Technologies: [National Security Agency Ghidra](https://junglewise.ai/threats/technologies/ghidra). Vendors: [National Security Agency](https://junglewise.ai/threats/vendors/national-security-agency).

## Quick answers

**Is CVE-2026-52757 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52757 being exploited in the wild.

**How severe is CVE-2026-52757?** Medium severity, with a CVSS score of 4.4, published 10 June 2026.

**Which products and versions are affected?** National Security Agency Ghidra < 12.1.

**Is there a fix for CVE-2026-52757?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-52757 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-52757?** Check whether you run National Security Agency Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-use-after-free (UAF) vulnerability exists in the Ghidra decompiler's HighVariable::merge() function during the variable merging pass. The root cause is an asymmetric cleanup in the HighIntersectTest::highedgemap cache; when moveIntersectTests() is called, it may fail to remove reverse entries for a HighVariable, leaving orphaned pointers. When the associated HighVariable object is subsequently deleted via mergeInternal(), these stale pointers remain in the cache. A later call to moveIntersectTests() dereferences these pointers to read or write the 'flags' field of the freed memory. This is reachable via the standard Java-to-native IPC path when a user opens a binary in the decompiler view or uses analyzeHeadless. The issue is fixed in Ghidra version 12.1.

## Affected products

- NSA Ghidra < 12.1

## Timeline

- 2026-05-15: advisory: GitHub Security Advisory published by NSA
- 2026-06-10: disclosed: NVD publication date

## References

- [https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-8jqp-qv73-395r](https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-8jqp-qv73-395r)
- [https://www.vulncheck.com/advisories/ghidra-heap-use-after-free-in-highvariable-merge-during-decompilation](https://www.vulncheck.com/advisories/ghidra-heap-use-after-free-in-highvariable-merge-during-decompilation)

## Related threats

- [Ghidra zip bomb in extension extraction](https://junglewise.ai/threats/cve-2026-115503-ghidra-before-12-2-contains-an-improper-handling-of-highly)
- [Ghidra resource allocation without limits in extension extraction](https://junglewise.ai/threats/cve-2026-115397-ghidra-before-12-2-contains-a-resource-allocation-without-limits)
- [Ghidra zip bomb vulnerability in theme import](https://junglewise.ai/threats/cve-2026-115396-ghidra-10-3-before-12-2-contains-an-improper-handling-of-highly)
- [Ghidra resource exhaustion in theme ZIP extraction](https://junglewise.ai/threats/cve-2026-115395-ghidra-10-3-before-12-2-contains-a-resource-allocation-without)
- [National Security Agency Ghidra heap out-of-bounds read in StringManager](https://junglewise.ai/threats/cve-2026-100505-ghidra-versions-11-2-through-12-1-4-contain-a-heap-out-of-bounds)