CVE-2026-52753: 
NixOS vulnerability analysis and mitigation

CVE-2026-52753 is an out-of-memory (OOM) vulnerability in Ghidra's GNU Demangler component (rust_demangle function) that allows an attacker to trigger unbounded memory allocation by supplying a maliciously crafted Rust symbol name in a binary. All Ghidra versions before 12.0.3 are affected. The vulnerability was published on June 10, 2026, with the security advisory originally published by NSA on February 11, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.7 (Medium) (GitHub Advisory).

The root cause is classified as CWE-789 (Memory Allocation with Excessive Size Value). The vulnerable str_buf_reserve() function in rust-demangle.c (lines 1530–1567) grows the output buffer exponentially via repeated doubling (new_cap *= 2) without any maximum size check, allowing a small ~61-byte malformed Rust v0 mangled symbol (prefixed with _R) to trigger allocation exceeding 2GB during lifetime printing in the demangling process. Exploitation requires local access and user interaction — specifically, a user must open or analyze a malicious binary in Ghidra, which internally passes attacker-controlled symbol names to the demangler_gnu native process via GnuDemanglerNativeProcess.java. The advisory includes a concrete PoC: a 61-byte base64-encoded payload that reliably crashes the process (GitHub Advisory).

Successful exploitation causes a Denial of Service (DoS) by crashing the Ghidra analysis process — the OOM killer terminates the process (exit code 137) after memory consumption grows from ~10MB to over 800MB within approximately 10 seconds. There is no confidentiality or integrity impact; the vulnerability is limited to availability of the Ghidra tool itself. Analysts relying on Ghidra for reverse engineering workflows could be disrupted if they open untrusted binaries containing crafted Rust symbols (GitHub Advisory).

1. Craft malicious binary: Generate a malicious binary containing a crafted Rust v0 mangled symbol (~61 bytes) using the published PoC payload:

echo "X1JJTnZDNHRlX0M0dG9rcHBwcHBwcHBwcEZGRkZGRkdGcHBwcHBwcHBwS2oyX0ZGRkZGRkZGRkZGRkU=" | base64 -d > crash_input.bin

2. Embed in binary: Package the crafted symbol name into a valid binary format (e.g., ELF or PE) that Ghidra will parse, or use the raw symbol directly if targeting the demangler_gnu CLI.
3. Deliver to target: Social-engineer or otherwise cause a Ghidra user to open the malicious binary for analysis (e.g., via a shared sample in a malware analysis workflow).
4. Trigger OOM: When Ghidra analyzes the binary, it passes the crafted symbol to demangler_gnu -s rust via GnuDemanglerNativeProcess.java. The str_buf_reserve() function enters exponential buffer growth, consuming all available memory and crashing the Ghidra process within ~10 seconds.
5. Verify crash: The process is killed by the OOM killer with exit code 137; Ghidra becomes unresponsive or terminates (GitHub Advisory).

• Process: Ghidra Java process or demangler_gnu subprocess terminated with exit code 137 (OOM kill); rapid memory growth of the demangler_gnu process from ~10MB to 800MB+ within seconds.
• Logs: System OOM killer log entries referencing demangler_gnu or Ghidra Java process in /var/log/syslog or dmesg (e.g., Out of memory: Kill process [PID] (demangler_gnu)).
• File System: Presence of unexpected binary files with Rust v0 symbol prefixes (_R) containing nested generic parameters; specifically files matching the 61-byte PoC pattern.
• Network: Delivery of malicious binary samples via email, file share, or download from untrusted sources to systems running Ghidra (GitHub Advisory).

Upgrade Ghidra to version 12.0.3 or later, which imposes a process timeout on the GNU Demangler to prevent unbounded execution. As a temporary workaround until patching is possible, restrict binary analysis to trusted files only and consider limiting the memory resources available to the Ghidra process (e.g., via OS-level memory limits or container constraints) to contain the impact of potential crashes. The upstream binutils issue is tracked at https://sourceware.org/bugzilla/show_bug.cgi?id=33878 (GitHub Advisory).

The vulnerability was discovered and disclosed by Team FuzzingBrain using an AI-based Vulnerability Detection System, as credited in the official NSA/Ghidra security advisory. No significant broader media coverage or notable social media reactions have been identified beyond standard CVE aggregator publications (GitHub Advisory).