Read the docs
TI-2026-40345 Aliases CVE-2026-55894

Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode

Priority MEDIUM 63CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table. An application using CS_ARCH_SH with CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU can pass crafted bytecode through cs_disasm_iter() or cs_disasm(), causing the decode[idx] test to read outside the table and terminate the process with a segmentation fault. No code execution or information disclosure was demonstrated. This issue is fixed in version 6.0.0-Alpha10.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00194 9th percentileScored 2026-11-07
Fix Partial capstone (capstone-engine): 6.0.0-Alpha10Red Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
capstone-enginecapstonebefore 6.0.0-Alpha106.0.0-Alpha10Patch availableCNA
  • capstone Vendorcapstone-engine Affected before 6.0.0-Alpha10 Fixed in 6.0.0-Alpha10 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:capstone-engine:capstone:*:*:*:*:*:*:*:*——capstone-engine
  • cpe:2.3:a:capstone-engine:capstone:*:*:*:*:*:*:*:* Versions — — ·capstone-engine

Remediation

  • Fix · CNA capstone (capstone-engine) Fixed in 6.0.0-Alpha10

Red Hat 1 advisory

  • RHSA-2026:59419 Released 2026-08-25 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images capstone-5.0.8-0.3.hum1@aarch64, capstone-5.0.8-0.3.hum1@src, capstone-5.0.8-0.3.hum1@x86_64 +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:59419

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55894
  2. 2026-11-06 Affected versions changed · Red Hat

References

Other 6

  • TI-2025-41703 Capstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflow CVSS 3.1CRITICAL 9.8
  • TI-2025-41500 Capstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflow CVSS 3.1HIGH 7.8
  • TI-2026-34733 Capstone has a NULL Pointer Dereference with 3DNow! opcodes CVSS 3.1MEDIUM 5.9
  • TI-2026-36469 Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes CVSS 3.1MEDIUM 5.1
  • TI-2026-36458 Capstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronization CVSS 4.0LOW 2.0
  • TI-2017-04662 Integer overflow in the cs_winkernel_malloc function in winkernel_mm.c in Capstone 3.0.4… CVSS 3.0HIGH 8.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences