Heap-Use-After-Free Vulnerability in Ghidra by National Security Agency

CVE-2026-52757

What is CVE-2026-52757?

Ghidra, the software reverse engineering tool developed by the National Security Agency, has a vulnerability that arises during the decompilation process. Specifically, the issue resides in the HighVariable::merge() function, where a heap-use-after-free condition can be triggered. Attackers can exploit this flaw by designing a specially crafted binary that leads to the dereferencing of stale pointers within the HighIntersectTest::highedgemap cache. This results in the reading and writing of the flags field associated with freed heap memory when a user opens the compromised binary in the Ghidra decompiler view, which could lead to potential exploitation.

References