Is there a patch available for CVE-2026-52756?

Yes, a patch is available for CVE-2026-52756. Update the affected software to the latest version immediately.

Ghidra CVE-2026-52756

Q: What is the CVSS score of CVE-2026-52756?

CVE-2026-52756 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-36015 MEDIUM

Path Traversal (CWE-22)

2026-06-10 VulnCheck

Path Traversal Ghidra

6.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 10, 2026 - 15:01 EUVD

Analysis Generated

Jun 10, 2026 - 14:29 vuln.today

CVSS changed

Jun 10, 2026 - 14:22 NVD

4.8 (MEDIUM) 6.3 (MEDIUM)

DescriptionCVE.org

Ghidra before 12.2 contains an unauthenticated path traversal vulnerability in the IsfServer that accepts TCP connections and passes client-supplied namespace strings directly to filesystem operations without validation. Remote attackers can connect to port 54321 and send crafted protobuf messages with traversal sequences to enumerate filesystem paths and probe arbitrary files.

AnalysisAI

Path traversal in Ghidra's IsfServer component (all versions before 12.2) allows remote unauthenticated attackers to enumerate filesystem paths and probe arbitrary files by connecting to TCP port 54321 and sending crafted protobuf messages. The root cause is unsanitized client-supplied namespace strings passed directly to filesystem operations, a CWE-22 defect. Given Ghidra's deployment context - security research, malware analysis, and reverse engineering of sensitive artifacts, often in high-value government and defense environments - successful exploitation could expose directory structures and sensitive file metadata on the analyst's workstation. No public exploit code has been identified and this vulnerability is not in CISA KEV at time of analysis.

Technical ContextAI

Ghidra is NSA's open-source software reverse engineering (SRE) framework (CPE: cpe:2.3:a:nationalsecurityagency:ghidra:*:*:*:*:*:*:*:*). The vulnerable component, IsfServer, is part of Ghidra's Debugger subsystem and listens on TCP port 54321 for client connections, using Protocol Buffers (protobuf) as its serialization format for inter-process or remote communication during debug sessions. The CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) root cause is the server's failure to sanitize or validate namespace strings submitted by clients before passing them to underlying filesystem operations. An attacker who controls the namespace field in a protobuf message can inject sequences such as '../../../' to escape the intended directory context and reach arbitrary filesystem paths. The CVSS 4.0 Attack Requirements metric is set to 'Present' (AT:P), reflecting that the IsfServer must be actively running and network-reachable for exploitation to occur.

RemediationAI

The primary fix is upgrading to Ghidra 12.2 or later, which resolves the unsanitized namespace string handling in IsfServer per the vendor advisory at https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-8pr2-46mf-v2r2. If immediate upgrade is not feasible, restrict network access to TCP port 54321 using host-based or network firewall rules so that only trusted local addresses can reach the IsfServer - this eliminates the network attack vector entirely with no functionality loss for single-user workstation deployments. Alternatively, disable the IsfServer component when remote debugging or collaborative session features are not actively required; this removes the attack surface at the cost of those specific workflow capabilities. Do not rely on perimeter firewall controls alone if Ghidra is used on shared analysis servers accessible from broader network segments. Organizations running Ghidra in air-gapped environments with no external TCP access to port 54321 face negligible practical risk from this vulnerability.