PatchSiren cyber security CVE debrief
CVE-2026-47143 capstone-engine CVE debrief
A NULL pointer dereference vulnerability exists in the Capstone disassembly framework, affecting versions prior to 6.0.0-Alpha8 and 5.0.8. The vulnerability occurs in the `modRMRequired()` and `decode()` functions when disassembling 3DNow! opcodes (`0F 0F`). A remote attacker can crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence `0F 0F <modrm> <imm8>`. This vulnerability can be mitigated by updating to version 6.0.0-Alpha8 or 5.0.8 or later, using compensating controls such as input validation and sanitization, and monitoring for and responding to potential attacks.
- Vendor
- capstone-engine
- Product
- capstone
- CVSS
- MEDIUM 5.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-21
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-21
- Advisory updated
- 2026-07-22
Who should care
Developers and users of the Capstone disassembly framework, particularly those using versions prior to 6.0.0-Alpha8 and 5.0.8, should be aware of this vulnerability and take steps to mitigate it. This includes updating to version 6.0.0-Alpha8 or 5.0.8 or later, using compensating controls such as input validation and sanitization, and monitoring for and responding to potential attacks.
Technical summary
The vulnerability is caused by a NULL pointer dereference in the `modRMRequired()` and `decode()` functions when disassembling 3DNow! opcodes (`0F 0F`). This occurs in builds compiled with `-DCAPSTONE_X86_REDUCE`. An attacker can exploit this vulnerability by supplying a crafted input containing the 4-byte sequence `0F 0F <modrm> <imm8>`, which can crash any application using the reduced X86 Capstone library. The vulnerability affects versions prior to 6.0.0-Alpha8 and 5.0.8 of the Capstone disassembly framework.
Defensive priority
Medium
Recommended defensive actions
- Update to version 6.0.0-Alpha8 or 5.0.8 or later
- Use a compensating control, such as input validation and sanitization
- Monitor for and respond to potential attacks
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Evidence notes
The CVE record was published on 2026-07-21T21:16:50.270Z and was last modified on 2026-07-22T14:17:19.527Z. The NVD entry is currently MEDIUM. The vulnerability affects versions prior to 6.0.0-Alpha8 and 5.0.8 of the Capstone disassembly framework. The vulnerability occurs in the `modRMRequired()` and `decode()` functions when disassembling 3DNow! opcodes (`0F 0F`). A remote attacker can crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence `0F 0F <modrm> <imm8>`.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T21:16:50.270Z and has not been modified since then.