CVE-2026-52757 is a heap-use-after-free vulnerability in the National Security Agency's Ghidra software before version 12.1. The flaw exists in the decompiler component, specifically in the HighVariable::merge() function during the variable merging pass. Attackers can exploit this by crafting a binary that causes stale pointers in the HighIntersectTest::highedgemap cache to be dereferenced, resulting in the reading and writing of freed heap memory's flags field when the binary is opened in the decompiler view.

Successful exploitation allows an attacker to cause use-after-free conditions in Ghidra's decompiler, potentially leading to memory corruption. This could result in application crashes or undefined behavior when analyzing malicious binaries. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the National Security Agency's Ghidra advisories for updates. Until a fix is available, avoid opening untrusted or specially crafted binaries in the decompiler view to reduce risk.