CVE-2026-55893

Received Received - Intake

Heap Buffer Overflow in Capstone Disassembler

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call set_reg() and set_reg_n() using sh_info.op.op_count without checking the fixed-size operands[] array. Repeated crafted instructions processed through cs_disasm_iter() or cs_disasm() with CS_ARCH_SH, CS_MODE_SH2A or CS_MODE_SH4A, CS_MODE_SHFPU, and CS_OPT_DETAIL can increment the operand count beyond the 176-byte sh_info allocation and perform a four-byte heap buffer overflow write. The corruption can crash the process and may enable code execution depending on heap layout. This issue is fixed in version 6.0.0-Alpha10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-55893

Affected Vendors & Products

Vendor	Product	Version / Range
capstone	capstone	to 6.0.0-alpha10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability is a heap buffer overflow in Capstone's SH floating-point decoders. It occurs when SH floating-point instructions like opFADD, opFMUL, and opFSUB are processed without proper bounds checking. The issue allows the operand count to exceed the allocated 176-byte sh_info buffer, leading to a four-byte heap overflow. This can crash the process and potentially enable code execution depending on the heap layout.

Detection Guidance

This vulnerability affects Capstone versions 6.0.0-Alpha9 and earlier when processing SH architecture instructions with specific modes. To detect it, check the Capstone version in use with commands like 'capstone_version' or inspect library files for version strings. Monitor for crashes or memory corruption when processing SH instructions with CS_ARCH_SH, CS_MODE_SH2A, CS_MODE_SH4A, CS_MODE_SHFPU, and CS_OPT_DETAIL enabled.

Impact Analysis

This vulnerability can impact you by causing crashes in applications using Capstone for SH architecture disassembly, particularly those using CS_ARCH_SH with SH2A, SH4A, or SHFPU modes. If exploited, it may allow arbitrary code execution, potentially leading to data breaches or system compromise. Users of affected versions should update to version 6.0.0-Alpha10 or later.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a heap buffer overflow in a disassembly framework. However, if exploited, it could lead to arbitrary code execution, potentially compromising systems handling sensitive data and indirectly impacting compliance.

Mitigation Strategies

Upgrade Capstone to version 6.0.0-Alpha10 or later immediately. If upgrading is not possible, disable support for SH architecture instructions (CS_ARCH_SH) and related modes (CS_MODE_SH2A, CS_MODE_SH4A, CS_MODE_SHFPU) in your application. Avoid using cs_disasm_iter() or cs_disasm() with these modes until patched.

Hi! I’m here to help you understand CVE-2026-55893. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70