Is there a patch available for CVE-2026-52753?

Yes, a patch is available for CVE-2026-52753. Update the affected software to the latest version immediately.

Ghidra CVE-2026-52753

Q: What is the CVSS score of CVE-2026-52753?

CVE-2026-52753 has a CVSS 4.0 base score of 6.7 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36012 MEDIUM

Memory Allocation with Excessive Size Value (CWE-789)

2026-06-10 VulnCheck

Denial Of Service Ghidra

6.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.7 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 10, 2026 - 15:01 EUVD

Analysis Generated

Jun 10, 2026 - 14:28 vuln.today

CVSS changed

Jun 10, 2026 - 14:22 NVD

5.5 (MEDIUM) 6.7 (MEDIUM)

DescriptionCVE.org

Ghidra before 12.0.3 contains an out-of-memory vulnerability in the rust_demangle function that allocates unbounded output buffers without size limits. Attackers can craft malicious Rust symbol names in binaries to trigger exponential memory allocation, causing process crashes during binary analysis.

AnalysisAI

Uncontrolled memory allocation in Ghidra's rust_demangle function (versions before 12.0.3) allows a denial-of-service condition when a user analyzes a specially crafted binary containing malicious Rust symbol names. The affected function allocates output buffers without enforcing size limits, enabling exponential memory growth that crashes the Ghidra process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the practical attack surface is real for teams that routinely analyze untrusted Rust binaries.

Technical ContextAI

Ghidra is NSA's open-source reverse engineering framework, and this vulnerability resides in its Rust symbol demangler (rust_demangle). CWE-789 (Uncontrolled Memory Allocation) describes the root cause: the function does not enforce an upper bound on the output buffer it allocates when expanding mangled Rust symbol names. Rust symbol mangling can encode deeply nested generic types or long identifier chains; a maliciously constructed symbol can cause the demangler to recursively or exponentially expand allocations, exhausting available process memory. The affected CPE is cpe:2.3:a:nationalsecurityagency:ghidra:*:*:*:*:*:*:*:* covering all Ghidra versions prior to 12.0.3. This is a pure availability issue - no code execution or data disclosure path is present.

RemediationAI

The primary remediation is to upgrade Ghidra to version 12.0.3 or later, which resolves the unbounded allocation in rust_demangle. The vendor fix is documented in GitHub Security Advisory GHSA-m94m-fqr3-x442. If immediate upgrade is not possible, organizations should restrict analysts from opening binaries sourced from untrusted or adversarial origins using Ghidra until patched; this directly eliminates the required user interaction prerequisite. A secondary compensating control is to run Ghidra analysis tasks within a resource-constrained container or virtual machine with a configured memory ceiling (e.g., using cgroup memory limits on Linux), which would cause the process to be killed before consuming all host memory and prevent host-level availability impact. This does not fix the crash but limits blast radius. Neither workaround is a substitute for patching.