Skip to content
OpenAdvisories
Medium · 6.8 CVE-2026-55894 EUVD-2026-63669

Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode

Published Aug 20, 2026 · Updated Aug 21, 2026 · Assigned by GitHub_M

Description

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table. An application using CS_ARCH_SH with CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU can pass crafted bytecode through cs_disasm_iter() or cs_disasm(), causing the decode[idx] test to read outside the table and terminate the process with a segmentation fault. No code execution or information disclosure was demonstrated. This issue is fixed in version 6.0.0-Alpha10.

Affected products

VendorProductAffectedFixed
capstone-engine capstone < 6.0.0-Alpha10 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 capstone No fix yet —
Debian 13 capstone No fix yet —
Debian 12 capstone No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 capstone No fix yet —
Ubuntu 26.04 LTS capstone No fix yet —
Ubuntu 24.04 LTS capstone No fix yet —
Ubuntu 22.04 LTS capstone No fix yet —
Ubuntu 20.04 LTS capstone No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS capstone No fix yet —
Ubuntu 16.04 LTS capstone No fix yet —
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 capstone +4 5.0.8-0.3.hum1 RHSA-2026:59419

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 capstone No fix yet —
Azure Linux 3 rust 1.96.1-1 —

Advisories 1

References