CVE-2026-52753: Ghidra DOS Vulnerability in Rust Demangle

CVE-2026-52753 Overview

CVE-2026-52753 is an out-of-memory vulnerability in Ghidra, the open source software reverse engineering framework maintained by the National Security Agency. The flaw resides in the rust_demangle function, which allocates unbounded output buffers without enforcing size limits. An attacker can craft a malformed Rust symbol name inside a binary so that Ghidra's demangler triggers exponential memory allocation when the analyst opens the file. This causes the Ghidra process to crash during binary analysis. The issue is tracked under [CWE-789: Memory Allocation with Excessive Size Value] and is fixed in Ghidra 12.0.3.

Critical Impact
Reverse engineers analyzing untrusted binaries containing crafted Rust symbols can experience Ghidra process crashes, disrupting analysis workflows and potentially destroying unsaved project state.

Affected Products

Ghidra versions prior to 12.0.3
National Security Agency Ghidra reverse engineering framework
Any Ghidra deployment processing untrusted Rust-compiled binaries

Discovery Timeline

2026-06-10 - CVE-2026-52753 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-52753

Vulnerability Analysis

Ghidra includes a Rust symbol demangler that converts mangled Rust identifiers back into human-readable function and type names during binary analysis. The rust_demangle function constructs an output buffer to hold the demangled string. The implementation does not bound the size of this buffer against the input or against available memory. Specially crafted Rust symbols can expand to extremely large output strings, causing the Java Virtual Machine hosting Ghidra to exhaust heap memory and terminate.

The attack requires user interaction. An analyst must load a malicious binary or apply analysis routines that invoke the Rust demangler. Exploitation does not yield code execution. The impact is limited to availability of the Ghidra process and any unsaved analysis state.

Root Cause

The root cause is missing size validation on the demangler output buffer. The rust_demangle routine processes mangled symbols recursively or iteratively and appends decoded fragments to a growing buffer. Because no upper bound or sanity check is applied to the produced length, an input symbol that encodes deeply nested or repeated constructs forces the demangler to allocate output proportional to that expansion. This pattern matches [CWE-789].

Attack Vector

The attack vector is local and requires user action. An attacker distributes a binary containing one or more malformed Rust mangled symbols. When a reverse engineer imports the binary and Ghidra performs symbol analysis, the demangler allocates excessive memory and the process crashes. The vulnerability cannot be triggered remotely without the analyst opening the file. No verified public exploit code is available. Technical details are described in the GitHub Security Advisory and the VulnCheck Advisory.

Detection Methods for CVE-2026-52753

Indicators of Compromise

Repeated Ghidra process termination with java.lang.OutOfMemoryError entries in application.log or console output during symbol analysis
Unusually long or malformed Rust mangled symbols beginning with _R or _ZN prefixes inside imported binaries
Spikes in JVM heap utilization correlating with Ghidra auto-analysis on newly imported files

Detection Strategies

Inspect imported binaries for Rust symbols whose mangled length exceeds normal compiler output before running auto-analysis
Monitor Ghidra JVM telemetry for sudden heap exhaustion events tied to the analysis worker thread
Verify the installed Ghidra version against the fixed release 12.0.3 across all analyst workstations

Monitoring Recommendations

Enable JVM garbage collection and out-of-memory logging on Ghidra hosts to capture allocation events for forensic review
Track endpoint process telemetry for repeated Ghidra crashes following the opening of externally sourced binaries
Correlate analyst workstation crashes with the source and hash of recently imported samples to identify suspect files

How to Mitigate CVE-2026-52753

Immediate Actions Required

Upgrade Ghidra to version 12.0.3 or later on all analyst systems
Restrict binary analysis of untrusted samples to isolated virtual machines or containers with constrained memory limits
Disable or skip Rust demangling during auto-analysis for binaries from unknown sources until the patch is applied

Patch Information

The National Security Agency released Ghidra 12.0.3, which bounds the output buffer in the rust_demangle function and rejects symbols that would expand beyond a safe limit. Patch details are published in the GitHub Security Advisory GHSA-m94m-fqr3-x442. Apply the upgrade by downloading the official release from the Ghidra GitHub repository and replacing existing installations.

Workarounds

Run Ghidra inside a sandboxed environment with a capped JVM heap size to contain crashes to a single analysis session
Pre-screen binaries with separate tooling to flag oversized or malformed Rust mangled symbols before importing into Ghidra
Save Ghidra projects frequently when analyzing untrusted Rust binaries to minimize loss of work from process termination

bash

# Configuration example: limit JVM heap to contain potential OOM impact
# Edit support/launch.properties or ghidraRun script
MAXMEM=4G

# Verify installed Ghidra version
./ghidraRun --version