CVE-2026-52757: Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() during decompilation
Ghidra before 12.1 contains a heap-use-after-free vulnerability in the decompiler's HighVariable::merge() function during the variable merging pass. Attackers can trigger this vulnerability by crafting a binary that causes stale pointers in the HighIntersectTest::highedgemap cache to be dereferenced, reading and writing the flags field of freed heap memory when a user opens the binary in Ghidra's decompiler view.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghidrato a version that resolves this vulnerability.Fixed in 12.1 - Compensating control
Do not open untrusted or unverified binaries in Ghidra's decompiler view; inspect or analyze unknown binaries only in a sandboxed or isolated environment until Ghidra is updated to 12.1.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52757?
The severity of CVE-2026-52757 is rated as medium with a score of 4.6.
How do I fix CVE-2026-52757?
To mitigate CVE-2026-52757, upgrade Ghidra to version 12.1 or later.
What type of vulnerability is CVE-2026-52757?
CVE-2026-52757 is a heap-use-after-free vulnerability.
Which function is affected in CVE-2026-52757?
CVE-2026-52757 affects the HighVariable::merge() function during decompilation.
Who is affected by CVE-2026-52757?
Users of Ghidra versions prior to 12.1 are affected by CVE-2026-52757.