Is CVE-2026-52759 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52759 being exploited in the wild.

How severe is CVE-2026-52759?

Medium severity, with a CVSS score of 5.5, published 10 June 2026.

Which products and versions are affected?

National Security Agency Ghidra < 12.1.1.

Is there a fix for CVE-2026-52759?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-52759 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-52759?

Check whether you run National Security Agency Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52759: NSA Ghidra denial of service in Mach-O binary parser

Q: Is there a fix for CVE-2026-52759?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-52759 attacked?

It is attacked with local access, in a network appliance.

Q: Am I affected by CVE-2026-52759?

Check whether you run National Security Agency Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52759 · Severity: medium · CVSS 5.5 · Published 2026-06-10

Ghidra is a popular open-source software reverse engineering suite used by security researchers to analyze malicious code. A vulnerability in its file-processing component allows a specially crafted file to crash the application immediately upon being opened. This can lead to a loss of unsaved work for analysts or disrupt automated security pipelines that process large volumes of files.

Technologies: National Security Agency Ghidra. Vendors: National Security Agency.

Quick answers

Is CVE-2026-52759 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52759 being exploited in the wild.
How severe is CVE-2026-52759?: Medium severity, with a CVSS score of 5.5, published 10 June 2026.
Which products and versions are affected?: National Security Agency Ghidra < 12.1.1.
Is there a fix for CVE-2026-52759?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-52759 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-52759?: Check whether you run National Security Agency Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An uncontrolled memory allocation vulnerability (CWE-789) exists in Ghidra's Mach-O binary parser within the MachHeader.java component. The parser unconditionally trusts the 'ncmds' (load command count) field from the Mach-O header and uses it to initialize an ArrayList. By providing a crafted binary with an arbitrarily large ncmds value, an attacker can force the JVM to attempt an oversized memory allocation that exceeds the available heap space, resulting in an OutOfMemoryError and application crash. This can be triggered during manual file import or via the headless analyzer. The issue is resolved in Ghidra version 12.1.1.

Affected products

NSA Ghidra < 12.1.1

Timeline

2026-06-08: advisory: GitHub Security Advisory published by NSA developers
2026-06-10: disclosed: NVD and VulnCheck publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.