CVE-2026-55894 capstone-engine CVE debrief

Who should care

Developers and users of the Capstone disassembly framework, particularly those using CS_ARCH_SH with CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU, should be aware of this vulnerability and take steps to mitigate it. This includes verifying and applying patches, restricting input to cs_disasm_iter() or cs_disasm(), and monitoring for updates from the Capstone engine development team. Additionally, security teams and vulnerability management teams should review the vulnerability and assess their exposure.

Technical summary

The Capstone disassembly framework, specifically versions 6.0.0-Alpha9 and earlier, is vulnerable to a segmentation fault caused by crafted bytecode. The issue arises from the sh_disassemble() function's computation of an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table. This vulnerability can be triggered through cs_disasm_iter() or cs_disasm() when using CS_ARCH_SH with CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU. The vulnerability was fixed in version 6.0.0-Alpha10.

Defensive priority

Medium-priority vulnerability in a disassembly framework; verify and apply patches.

Recommended defensive actions

• Verify and apply patches for Capstone version 6.0.0-Alpha10 or later.
• Restrict input to cs_disasm_iter() or cs_disasm() to prevent crafted bytecode.
• Monitor for updates from the Capstone engine development team.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE-2026-55894 vulnerability in Capstone, a disassembly framework, allows for a segmentation fault via crafted bytecode. Official CVE and NVD records provide details. Limited evidence suggests a Medium CVSS score of 6.8. The vulnerability was introduced in version 6.0.0-Alpha9 and fixed in version 6.0.0-Alpha10. Users should verify and apply patches. The issue arises from the sh_disassemble() function's computation of an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table.

Official resources