Read the docs
TI-2026-34733 Aliases CVE-2026-47143

Capstone has a NULL Pointer Dereference with 3DNow! opcodes

Priority MEDIUM 60CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with `-DCAPSTONE_X86_REDUCE`, allowing a remote attacker to crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence `0F 0F <modrm> <imm8>`. Versions 6.0.0-Alpha8 and 5.0.8 patch the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00468 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed capstone (capstone-engine): 5.0.8, 6.0.0-Alpha8Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
capstone-enginecapstonebefore 5.0.8; before 6.0.0-Alpha85.0.8, 6.0.0-Alpha8Patch availableCNA
  • capstone Vendorcapstone-engine Affected before 5.0.8; before 6.0.0-Alpha8 Fixed in 5.0.8, 6.0.0-Alpha8 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:capstone-engine:capstone:*:*:*:*:*:*:*:*before 5.0.8Vulnerablecapstone-engine
cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha1:*:*:*:*:*:*6.0.0 alpha1Vulnerablecapstone-engine
cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha2:*:*:*:*:*:*6.0.0 alpha2Vulnerablecapstone-engine
cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha3:*:*:*:*:*:*6.0.0 alpha3Vulnerablecapstone-engine
cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha4:*:*:*:*:*:*6.0.0 alpha4Vulnerablecapstone-engine
cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha5:*:*:*:*:*:*6.0.0 alpha5Vulnerablecapstone-engine
cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha6:*:*:*:*:*:*6.0.0 alpha6Vulnerablecapstone-engine
cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha7:*:*:*:*:*:*6.0.0 alpha7Vulnerablecapstone-engine
  • cpe:2.3:a:capstone-engine:capstone:*:*:*:*:*:*:*:* Versions before 5.0.8 Vulnerable ·capstone-engine
  • cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha1:*:*:*:*:*:* Versions 6.0.0 alpha1 Vulnerable ·capstone-engine
  • cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha2:*:*:*:*:*:* Versions 6.0.0 alpha2 Vulnerable ·capstone-engine
  • cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha3:*:*:*:*:*:* Versions 6.0.0 alpha3 Vulnerable ·capstone-engine
  • cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha4:*:*:*:*:*:* Versions 6.0.0 alpha4 Vulnerable ·capstone-engine
  • cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha5:*:*:*:*:*:* Versions 6.0.0 alpha5 Vulnerable ·capstone-engine
  • cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha6:*:*:*:*:*:* Versions 6.0.0 alpha6 Vulnerable ·capstone-engine
  • cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha7:*:*:*:*:*:* Versions 6.0.0 alpha7 Vulnerable ·capstone-engine

Remediation

  • Fix · CNA capstone (capstone-engine) Fixed in 5.0.8, 6.0.0-Alpha8

Red Hat 1 advisory

  • RHSA-2026:43841 Released 2026-07-22 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images capstone-5.0.8-0.1.hum1@aarch64, capstone-5.0.8-0.1.hum1@src, capstone-5.0.8-0.1.hum1@x86_64 +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:43841
Not affected: 5 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47143
  2. 2026-11-06 Affected versions changed · Red Hat

References

Exploit 1

Patch 3

  • TI-2025-41703 Capstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflow CVSS 3.1CRITICAL 9.8
  • TI-2025-41500 Capstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflow CVSS 3.1HIGH 7.8
  • TI-2017-04662 Integer overflow in the cs_winkernel_malloc function in winkernel_mm.c in Capstone 3.0.4… CVSS 3.0HIGH 8.8
  • TI-2016-06150 Capstone 3.0.4 has an out-of-bounds vulnerability (SEGV caused by a read memory access)… CVSS 3.0MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences