CVE-2026-55894

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55894", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-17T16:59:42.760Z", "datePublished": "2026-08-20T21:31:37.680Z", "dateUpdated": "2026-08-21T15:00:05.011Z"}, "containers": {"cna": {"title": "Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-gf2c-xwcp-hvf4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-gf2c-xwcp-hvf4"}, {"name": "https://github.com/capstone-engine/capstone/pull/2968", "tags": ["x_refsource_MISC"], "url": "https://github.com/capstone-engine/capstone/pull/2968"}, {"name": "https://github.com/capstone-engine/capstone/pull/2969", "tags": ["x_refsource_MISC"], "url": "https://github.com/capstone-engine/capstone/pull/2969"}, {"name": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e", "tags": ["x_refsource_MISC"], "url": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e"}, {"name": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed", "tags": ["x_refsource_MISC"], "url": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed"}, {"name": "https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10", "tags": ["x_refsource_MISC"], "url": "https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10"}], "affected": [{"vendor": "capstone-engine", "product": "capstone", "versions": [{"version": "< 6.0.0-Alpha10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:31:37.680Z"}, "descriptions": [{"lang": "en", "value": "Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table. An application using CS_ARCH_SH with CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU can pass crafted bytecode through cs_disasm_iter() or cs_disasm(), causing the decode[idx] test to read outside the table and terminate the process with a segmentation fault. No code execution or information disclosure was demonstrated. This issue is fixed in version 6.0.0-Alpha10."}], "source": {"advisory": "GHSA-gf2c-xwcp-hvf4", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-gf2c-xwcp-hvf4", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T14:59:57.566989Z", "id": "CVE-2026-55894", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T15:00:05.011Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55894", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T14:59:57.566989Z"}}}], "references": [{"url": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-gf2c-xwcp-hvf4", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T14:59:17.745Z"}}], "cna": {"title": "Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode", "source": {"advisory": "GHSA-gf2c-xwcp-hvf4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "capstone-engine", "product": "capstone", "versions": [{"status": "affected", "version": "< 6.0.0-Alpha10"}]}], "references": [{"url": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-gf2c-xwcp-hvf4", "name": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-gf2c-xwcp-hvf4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/capstone-engine/capstone/pull/2968", "name": "https://github.com/capstone-engine/capstone/pull/2968", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/capstone-engine/capstone/pull/2969", "name": "https://github.com/capstone-engine/capstone/pull/2969", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e", "name": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed", "name": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10", "name": "https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table. An application using CS_ARCH_SH with CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU can pass crafted bytecode through cs_disasm_iter() or cs_disasm(), causing the decode[idx] test to read outside the table and terminate the process with a segmentation fault. No code execution or information disclosure was demonstrated. This issue is fixed in version 6.0.0-Alpha10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:31:37.680Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55894", "state": "PUBLISHED", "dateUpdated": "2026-08-21T15:00:05.011Z", "dateReserved": "2026-06-17T16:59:42.760Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T21:31:37.680Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "capstone", "vendor": "capstone-engine", "versions": [{"status": "affected", "version": "< 6.0.0-Alpha10"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table. An application using CS_ARCH_SH with CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU can pass crafted bytecode through cs_disasm_iter() or cs_disasm(), causing the decode[idx] test to read outside the table and terminate the process with a segmentation fault. No code execution or information disclosure was demonstrated. This issue is fixed in version 6.0.0-Alpha10."}, {"lang": "es", "value": "Capstone es un framework de desensamblaje. En 6.0.0-Alpha9 y versiones anteriores, la funci\u00f3n sh_disassemble() de arch/SH/SHDisassembler.c de Capstone calcula un valor idx a partir de una instrucci\u00f3n bruta de 16 bits sin asegurar que est\u00e9 dentro de la tabla de punteros a funciones decode[] activa y espec\u00edfica del modo. Una aplicaci\u00f3n que utiliza CS_ARCH_SH con CS_MODE_SH2A o CS_MODE_SH4A y CS_MODE_SHFPU puede pasar bytecode manipulado a trav\u00e9s de cs_disasm_iter() o cs_disasm(), haciendo que la prueba decode[idx] lea fuera de la tabla y termine el proceso con un fallo de segmentaci\u00f3n. No se demostr\u00f3 ejecuci\u00f3n de c\u00f3digo ni revelaci\u00f3n de informaci\u00f3n. Este problema est\u00e1 corregido en la versi\u00f3n 6.0.0-Alpha10."}], "id": "CVE-2026-55894", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55894", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T14:59:57.566989Z", "version": "2.0.3"}}]}, "published": "2026-08-20T22:17:22.930", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e"}, {"source": "security-advisories@github.com", "url": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed"}, {"source": "security-advisories@github.com", "url": "https://github.com/capstone-engine/capstone/pull/2968"}, {"source": "security-advisories@github.com", "url": "https://github.com/capstone-engine/capstone/pull/2969"}, {"source": "security-advisories@github.com", "url": "https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10"}, {"source": "security-advisories@github.com", "url": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-gf2c-xwcp-hvf4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-gf2c-xwcp-hvf4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "capstone: Capstone: Denial of Service via crafted SH2A bytecode", "id": "2520820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520820"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table. An application using CS_ARCH_SH with CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU can pass crafted bytecode through cs_disasm_iter() or cs_disasm(), causing the decode[idx] test to read outside the table and terminate the process with a segmentation fault. No code execution or information disclosure was demonstrated. This issue is fixed in version 6.0.0-Alpha10.", "A flaw was found in Capstone, a disassembly framework. The `sh_disassemble()` function incorrectly processes 16-bit instructions, leading to an attempt to read data from an unauthorized memory location (an out-of-bounds read). A remote attacker could exploit this by providing specially crafted bytecode to an application using Capstone in specific modes (SH2A or SH4A with SHFPU). This could cause the application to crash, resulting in a Denial of Service (DoS), where the service becomes unavailable. No code execution or information disclosure was demonstrated as a result of this flaw."], "name": "CVE-2026-55894", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "capstone", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "capstone", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Fix deferred", "package_name": "capstone", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-20T21:31:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-55894\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-55894\nhttps://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e\nhttps://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed\nhttps://github.com/capstone-engine/capstone/pull/2968\nhttps://github.com/capstone-engine/capstone/pull/2969\nhttps://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10\nhttps://github.com/capstone-engine/capstone/security/advisories/GHSA-gf2c-xwcp-hvf4"], "statement": "This Moderate impact flaw in Capstone's SH disassembler can lead to a denial of service. An application processing specially crafted SH2A or SH4A bytecode with Capstone configured for these specific modes may crash due to an out-of-bounds read. This issue does not result in code execution or information disclosure, limiting its severity to service disruption.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.0.0-Alpha10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "capstone", "source": "cna", "vendor": "capstone-engine"}, "product": "capstone", "vendor": "capstone-engine"}], "created": "2026-08-20T22:45:02.857093+00:00", "updated": "2026-08-21T01:00:04.535831+00:00", "vendors": ["capstone-engine", "capstone-engine$PRODUCT$capstone"]}