Is there a patch available for CVE-2026-52759?

Yes, a patch is available for CVE-2026-52759. Update the affected software to the latest version immediately.

Ghidra CVE-2026-52759

Q: What is the CVSS score of CVE-2026-52759?

CVE-2026-52759 has a CVSS 4.0 base score of 6.7 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36018 MEDIUM

Memory Allocation with Excessive Size Value (CWE-789)

2026-06-10 VulnCheck

Denial Of Service Ghidra

6.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.7 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 10, 2026 - 15:01 EUVD

Analysis Generated

Jun 10, 2026 - 14:31 vuln.today

CVSS changed

Jun 10, 2026 - 14:22 NVD

5.5 (MEDIUM) 6.7 (MEDIUM)

DescriptionCVE.org

Ghidra before 12.1.1 contains an uncontrolled memory allocation vulnerability in the Mach-O binary parser that allows attackers to cause denial of service. An attacker can supply a crafted Mach-O binary with an arbitrarily large ncmds load command count value, forcing the parser to allocate excessive heap memory without validating file size, crashing the Ghidra JVM.

AnalysisAI

Uncontrolled heap memory allocation in Ghidra's Mach-O binary parser (versions before 12.1.1) allows denial of service by crashing the Ghidra JVM. The parser reads the ncmds load command count field directly from a Mach-O file header and uses it to drive heap allocation without cross-validating it against the actual file size, enabling a crafted binary to exhaust JVM memory. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the attack primitive is straightforward to reproduce from the description.

Technical ContextAI

Ghidra is the NSA's open-source reverse engineering framework widely used by security researchers and malware analysts. The affected component is its Mach-O binary parser; Mach-O is the executable and object file format used on Apple platforms (macOS, iOS). The Mach-O header contains an ncmds field specifying the number of load commands that follow, which the parser uses to allocate data structures. CWE-789 (Uncontrolled Memory Allocation) describes exactly this root cause: user-controlled input directly controls the size of a memory allocation without bound-checking against a reliable constraint such as actual file size. The affected CPE is cpe:2.3:a:ghidra:ghidra:*:*:*:*:*:*:*:*, covering all Ghidra releases prior to 12.1.1.

RemediationAI

Upgrade to Ghidra 12.1.1 or later, which introduces validation of the ncmds load command count against actual file size before performing heap allocation in the Mach-O parser. The authoritative patch advisory is the GitHub Security Advisory GHSA-v6c3-h9cp-3whf at https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v6c3-h9cp-3whf. Prior to patching, the primary compensating control is operational: analysts should avoid opening Mach-O binaries from untrusted or adversarial sources on unpatched Ghidra installations. As a secondary control, running Ghidra inside a resource-constrained environment (e.g., a VM with a capped JVM heap via the -Xmx flag in launch.properties) limits the blast radius of a crash to that isolated session and avoids host-level memory exhaustion, though it does not prevent the JVM crash itself.