CVE-2026-52759: Ghidra < 12.1.1 - Denial of Service via Uncontrolled Memory Allocation in Mach-O Parser
Ghidra before 12.1.1 contains an uncontrolled memory allocation vulnerability in the Mach-O binary parser that allows attackers to cause denial of service. An attacker can supply a crafted Mach-O binary with an arbitrarily large ncmds load command count value, forcing the parser to allocate excessive heap memory without validating file size, crashing the Ghidra JVM.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghidrato a version that resolves this vulnerability.Fixed in 12.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52759?
CVE-2026-52759 has a medium severity rating of 6.7.
What are the potential impacts of CVE-2026-52759?
CVE-2026-52759 can lead to denial of service due to uncontrolled memory allocation in the Mach-O parser.
How do I fix CVE-2026-52759?
To fix CVE-2026-52759, you should upgrade to Ghidra version 12.1.1 or later.
Who is affected by CVE-2026-52759?
Users of Ghidra versions prior to 12.1.1 are affected by CVE-2026-52759.
What attack vector is used in CVE-2026-52759?
CVE-2026-52759 can be exploited by supplying a crafted Mach-O binary with a large ncmds load command count.