# CVE-2026-52759: NSA Ghidra denial of service in Mach-O binary parser

Source: https://junglewise.ai/threats/cve-2026-52759-nsa-ghidra-denial-of-service-in-mach-o-binary-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-52759 · Severity: medium · CVSS 5.5 · Published 2026-06-10

Ghidra is a popular open-source software reverse engineering suite used by security researchers to analyze malicious code. A vulnerability in its file-processing component allows a specially crafted file to crash the application immediately upon being opened. This can lead to a loss of unsaved work for analysts or disrupt automated security pipelines that process large volumes of files.

Technologies: [National Security Agency Ghidra](https://junglewise.ai/threats/technologies/ghidra). Vendors: [National Security Agency](https://junglewise.ai/threats/vendors/national-security-agency).

## Quick answers

**Is CVE-2026-52759 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52759 being exploited in the wild.

**How severe is CVE-2026-52759?** Medium severity, with a CVSS score of 5.5, published 10 June 2026.

**Which products and versions are affected?** National Security Agency Ghidra < 12.1.1.

**Is there a fix for CVE-2026-52759?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-52759 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-52759?** Check whether you run National Security Agency Ghidra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An uncontrolled memory allocation vulnerability (CWE-789) exists in Ghidra's Mach-O binary parser within the MachHeader.java component. The parser unconditionally trusts the 'ncmds' (load command count) field from the Mach-O header and uses it to initialize an ArrayList. By providing a crafted binary with an arbitrarily large ncmds value, an attacker can force the JVM to attempt an oversized memory allocation that exceeds the available heap space, resulting in an OutOfMemoryError and application crash. This can be triggered during manual file import or via the headless analyzer. The issue is resolved in Ghidra version 12.1.1.

## Affected products

- NSA Ghidra < 12.1.1

## Timeline

- 2026-06-08: advisory: GitHub Security Advisory published by NSA developers
- 2026-06-10: disclosed: NVD and VulnCheck publication date

## References

- [https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v6c3-h9cp-3whf](https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v6c3-h9cp-3whf)
- [https://www.vulncheck.com/advisories/ghidra-denial-of-service-via-uncontrolled-memory-allocation-in-mach-o-parser](https://www.vulncheck.com/advisories/ghidra-denial-of-service-via-uncontrolled-memory-allocation-in-mach-o-parser)

## Related threats

- [Ghidra zip bomb in extension extraction](https://junglewise.ai/threats/cve-2026-115503-ghidra-before-12-2-contains-an-improper-handling-of-highly)
- [Ghidra resource allocation without limits in extension extraction](https://junglewise.ai/threats/cve-2026-115397-ghidra-before-12-2-contains-a-resource-allocation-without-limits)
- [Ghidra zip bomb vulnerability in theme import](https://junglewise.ai/threats/cve-2026-115396-ghidra-10-3-before-12-2-contains-an-improper-handling-of-highly)
- [Ghidra resource exhaustion in theme ZIP extraction](https://junglewise.ai/threats/cve-2026-115395-ghidra-10-3-before-12-2-contains-a-resource-allocation-without)
- [National Security Agency Ghidra heap out-of-bounds read in StringManager](https://junglewise.ai/threats/cve-2026-100505-ghidra-versions-11-2-through-12-1-4-contain-a-heap-out-of-bounds)