CVE-2026-52757 Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() during decompilation
Attackers can achieve code execution or cause denial of service by tricking users into opening a malicious binary in Ghidra's decompiler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-52757?
CVE-2026-52757 is a medium-severity use after free vulnerability in nationalsecurityagency ghidra, published on 10 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Ghidra before 12.1 contains a heap-use-after-free vulnerability in the decompiler's HighVariable::merge() function during the variable merging pass. Attackers can trigger this vulnerability by crafting a binary that causes stale pointers in the HighIntersectTest::highedgemap cache to be dereferenced, reading and writing the flags field of freed heap memory when a user opens the binary in Ghidra's decompiler view.
Weakness: CWE-416
Which versions are affected by CVE-2026-52757?
It affects 1 product.
Products include Nsa Ghidra.
How do I fix CVE-2026-52757?
No fix has been published for CVE-2026-52757 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-52757 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52757 exists.
Other vulnerabilities in nationalsecurityagency ghidra
Sources
Also known as GHSA-8jqp-qv73-395r.