CVE-2026-55893: Capstone SH disassembler `set_reg_n` heap buffer overflow via crafted SH2A FPU bytecode
Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call setreg() and setregn() using shinfo.op.opcount without checking the fixed-size operands[] array. Repeated crafted instructions processed through csdisasmiter() or csdisasm() with CSARCHSH, CSMODESH2A or CSMODESH4A, CSMODESHFPU, and CSOPTDETAIL can increment the operand count beyond the 176-byte shinfo allocation and perform a four-byte heap buffer overflow write. The corruption can crash the process and may enable code execution depending on heap layout. This issue is fixed in version 6.0.0-Alpha10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capstoneto a version that resolves this vulnerability.Fixed in 6.0.0-Alpha10
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Capstone 6.0.0-Alpha9 or earlier are exposed when they disassemble SH bytecode with CS_ARCH_SH, an SH2A or SH4A mode, CS_MODE_SHFPU, and CS_OPT_DETAIL enabled.
What must an attacker control to trigger the overflow?
An attacker needs to supply repeated crafted SH2A FPU instructions that are processed through cs_disasm_iter() or cs_disasm() under the affected architecture, mode, FPU, and detail settings.
What is the impact of successful exploitation?
The crafted instruction sequence can cause a four-byte heap buffer overflow write beyond the 176-byte sh_info allocation. This can crash the process and may permit code execution depending on the heap layout.
How can this be remediated?
Upgrade to Capstone 6.0.0-Alpha10, which fixes the issue.