Back to overview

CVE-2026-52757

MEDIUM Exploitation: PoC
4.4
CVSS 3.1
Description
Ghidra before 12.1 contains a heap-use-after-free vulnerability in the decompiler's HighVariable::merge() function during the variable merging pass. Attackers can trigger this vulnerability by crafting a binary that causes stale pointers in the HighIntersectTest::highedgemap cache to be dereferenced, reading and writing the flags field of freed heap memory when a user opens the binary in Ghidra's decompiler view.

Metadata

CVE ID
CVE-2026-52757
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-06-08 15:20 UTC
Published
2026-06-10 12:42 UTC
Last updated
2026-06-10 16:31 UTC
Primary CWE
CWE-416
Use After Free
Vendor / Product
nationalsecurityagency / ghidra
Sources
cve.org  ·  NVD

Severity & Metrics

4.4 MEDIUM CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
nationalsecurityagency ghidra — 0 < 12.1, 12.1
Weakness (CWE)
CWESourceDescription
CWE-416 cna Use After Free
CVSS scores (2)
ScoreSeverityVersionSourceVector
4.6 MEDIUM 4.0 cna CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
4.4 MEDIUM 3.1 cna CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
References (2)
Back to overview