VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Jun 10, 2026· Updated Jun 10, 2026

CVE-2026-52759

CVE-2026-52759

Description

Ghidra before 12.1.1 contains an uncontrolled memory allocation vulnerability in the Mach-O binary parser that allows attackers to cause denial of service. An attacker can supply a crafted Mach-O binary with an arbitrarily large ncmds load command count value, forcing the parser to allocate excessive heap memory without validating file size, crashing the Ghidra JVM.

Affected products

1

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"The Mach-O binary parser unconditionally trusts the ncmds field, leading to excessive memory allocation."

Attack vector

An attacker can craft a Mach-O binary with an arbitrarily large value in the ncmds field of its header. This crafted binary can then be supplied to Ghidra, either through its GUI or headless analyzer. The parser will attempt to allocate memory for a list of load commands based on this inflated value, regardless of the actual file size. This leads to an OutOfMemoryError, crashing the Ghidra JVM. [ref_id=1]

Affected code

The vulnerability resides in the Mach-O binary parsing logic within Ghidra's MachHeader.java file, specifically in the parse() method. The parser iterates over load commands based on the ncmds field from the Mach-O header without validating against the file's actual size. [ref_id=1]

What the fix does

The advisory states that the vulnerability is present in all known Ghidra releases and has not been patched. Therefore, no fix explanation can be provided. Users are advised to avoid importing untrusted Mach-O binaries. [ref_id=1]

Preconditions

  • inputThe attacker must provide a crafted Mach-O binary with an inflated ncmds value.
  • inputThe target must import or analyze the crafted Mach-O binary using Ghidra.

Reproduction

Run Ghidra's headless analyzer to import one of the PoC files: ghidra/analyzeHeadless /tmp/ TestProject -import 03f9d9d6.bin -overwrite Resulting Stack Trace: ERROR Abort due to Headless analyzer error: Java heap space (HeadlessAnalyzer) java.lang.OutOfMemoryError: Java heap space at java.base/java.util.Arrays.copyOf(Arrays.java:3482) at java.base/java.util.ArrayList.grow(ArrayList.java:237) at java.base/java.util.ArrayList.grow(ArrayList.java:244) at java.base/java.util.ArrayList.add(ArrayList.java:483) at java.base/java.util.ArrayList.add(ArrayList.java:496) at ghidra.app.util.bin.format.macho.MachHeader.parse(MachHeader.java:189) at ghidra.app.util.bin.format.macho.MachHeader.parse(MachHeader.java:150) [ref_id=1]

Generated on Jun 10, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

2

News mentions

1