CVE-2026-55894: Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode
Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c shdisassemble() function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table. An application using CSARCHSH with CSMODESH2A or CSMODESH4A and CSMODESHFPU can pass crafted bytecode through csdisasmiter() or csdisasm(), causing the decode[idx] test to read outside the table and terminate the process with a segmentation fault. No code execution or information disclosure was demonstrated. This issue is fixed in version 6.0.0-Alpha10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
capstoneto a version that resolves this vulnerability.Fixed in 6.0.0-Alpha10
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Capstone with CS_ARCH_SH in CS_MODE_SH2A, or CS_MODE_SH4A together with CS_MODE_SHFPU, are affected when they disassemble attacker-controlled SH bytecode. Other architectures and modes are not identified as affected.
What must an attacker provide to trigger the crash?
An attacker needs to cause the application to pass crafted SH2A bytecode to cs_disasm_iter() or cs_disasm(). The malformed instruction causes sh_disassemble() to use an unchecked index when accessing the active mode-specific decode table, which can terminate the process with a segmentation fault.
What is the practical impact?
The demonstrated impact is denial of service through process termination. No code execution or information disclosure was demonstrated.
Which version contains the fix?
The issue is fixed in Capstone 6.0.0-Alpha10. Versions 6.0.0-Alpha9 and earlier are affected according to the available information.