CVE-2026-55894

Received Received - Intake

Buffer Overflow in Capstone Disassembly Framework

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table. An application using CS_ARCH_SH with CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU can pass crafted bytecode through cs_disasm_iter() or cs_disasm(), causing the decode[idx] test to read outside the table and terminate the process with a segmentation fault. No code execution or information disclosure was demonstrated. This issue is fixed in version 6.0.0-Alpha10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-55894

Affected Vendors & Products

Vendor	Product	Version / Range
capstone	capstone	to 6.0.0-alpha10 (exc)
capstone	capstone	6.0.0-alpha10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Capstone, a disassembly framework. It occurs in versions 6.0.0-Alpha9 and earlier. The issue is in the SHDisassembler.c file where a function computes an index from a 16-bit instruction without checking if it fits within a decode table. This can cause a segmentation fault when using specific architectures like CS_ARCH_SH with CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU.

Detection Guidance

This vulnerability affects Capstone versions 6.0.0-Alpha9 and earlier when using CS_ARCH_SH with CS_MODE_SH2A, CS_MODE_SH4A, or CS_MODE_SHFPU. To detect it, check the installed Capstone version with a command like 'capstone_version' or inspect the library version in your application. If using a vulnerable version, update to 6.0.0-Alpha10 or later.

Impact Analysis

If you use Capstone with the affected architectures, an attacker could craft malicious bytecode to crash your application via a segmentation fault. This could lead to denial of service but does not allow code execution or information disclosure.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it only causes a segmentation fault without code execution or information disclosure. Compliance impact would depend on how the affected Capstone library is used in a system.

Mitigation Strategies

Immediately update Capstone to version 6.0.0-Alpha10 or later. If updating is not possible, avoid using CS_ARCH_SH with CS_MODE_SH2A, CS_MODE_SH4A, or CS_MODE_SHFPU until patched. Monitor applications for segmentation faults when processing SH architecture bytecode.

Hi! I’m here to help you understand CVE-2026-55894. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70