CVE-2026-47143

Received Received - Intake

NULL Pointer Dereference in Capstone Disassembly Framework

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with `-DCAPSTONE_X86_REDUCE`, allowing a remote attacker to crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence `0F 0F <modrm> <imm8>`. Versions 6.0.0-Alpha8 and 5.0.8 patch the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-47143

Affected Vendors & Products

Vendor	Product	Version / Range
capstone	capstone	to 6.0.0-alpha8\|end_excluding=5.0.8 (exc)
capstone	capstone	6.0.0-alpha8
capstone	capstone	5.0.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference in the Capstone disassembly framework affecting versions prior to 6.0.0-Alpha8 and 5.0.8. It occurs when disassembling 3DNow! opcodes (0F 0F) in builds compiled with -DCAPSTONE_X86_REDUCE. A crafted input with the sequence 0F 0F <modrm> <imm8> can crash applications using the reduced X86 Capstone library.

Detection Guidance

This vulnerability can be detected by checking if your system uses Capstone versions prior to 6.0.0-Alpha8 or 5.0.8. Inspect the library version in use with commands like 'ldd' or 'nm' on Linux, or check the installed package version via package managers like 'apt' or 'yum'.

Impact Analysis

This vulnerability allows a remote attacker to crash any application using the affected Capstone library by providing a specially crafted input. This could lead to denial-of-service conditions, disrupting the availability of services relying on Capstone for disassembly tasks.

Mitigation Strategies

Upgrade Capstone to version 6.0.0-Alpha8 or 5.0.8 or later. If using a reduced X86 Capstone build with `-DCAPSTONE_X86_REDUCE`, ensure the latest patched version is installed to prevent NULL pointer dereference crashes from crafted 3DNow! opcodes.

Hi! I’m here to help you understand CVE-2026-47143. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70