CVE-2026-55894: CWE-125: Out-of-bounds Read in capstone-engine capstone
Description
CVE-2026-55894 is an out-of-bounds read vulnerability in the capstone disassembly framework affecting versions before 6.0.0-Alpha10. The flaw occurs in the SH architecture disassembler when processing certain crafted bytecode, leading to a segmentation fault. No code execution or information disclosure has been demonstrated. The issue is fixed in version 6.0.0-Alpha10.
CVSS v4.0
Score 6.8medium
Affected software
capstone-engine
capstone
pkg:github/capstone-engine/capstoneRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In capstone-engine versions 6.0.0-Alpha9 and earlier, the sh_disassemble() function in arch/SH/SHDisassembler.c computes an index from a raw 16-bit instruction without validating that the index is within the bounds of the decode[] function-pointer table. When using CS_ARCH_SH with modes CS_MODE_SH2A or CS_MODE_SH4A combined with CS_MODE_SHFPU, specially crafted bytecode passed to cs_disasm_iter() or cs_disasm() can cause an out-of-bounds read on decode[], resulting in a segmentation fault and process termination. No further exploitation such as code execution or data leakage has been shown. The vulnerability is addressed in version 6.0.0-Alpha10.
Potential Impact
The vulnerability causes a denial of service via a segmentation fault when processing crafted instructions under specific SH architecture modes. There is no evidence of code execution or information disclosure. The impact is limited to process termination.
Mitigation Recommendations
Upgrade to capstone version 6.0.0-Alpha10 or later, where this vulnerability is fixed. No other mitigation is required as the issue is resolved in the official patch.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-17T16:59:42.760Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a87778eacd9273b492c5fad
Added to database: 08/20/2026, 21:54:22 UTC
Last enriched: 09/11/2026, 03:48:25 UTC
Last updated: 10/05/2026, 06:48:17 UTC
Views: 67
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.