CVE-2026-52757 is a heap-use-after-free vulnerability affecting Ghidra before version 12.1. It exists in the decompiler component, specifically within the HighVariable::merge() function during the variable merging pass. An attacker can craft a binary that causes stale pointers in the HighIntersectTest::highedgemap cache to be dereferenced, resulting in the reading and writing of the flags field of freed heap memory when the binary is opened in the decompiler view. This vulnerability requires user interaction (opening the binary) and local access to the Ghidra tool. No official patch or remediation level has been stated in the available data.

Successful exploitation allows an attacker to cause use-after-free conditions in Ghidra's decompiler, potentially leading to memory corruption. The CVSS score of 4.6 indicates a medium impact, with local attack vector and low complexity. There is no indication of privilege escalation or remote exploitation without user interaction. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening untrusted binaries in Ghidra, especially versions prior to 12.1. Monitoring vendor channels for updates is recommended.