Vulnerability-Lookup

RHSA-2026:59419

Vulnerability from csaf_redhat - Published: 2026-08-25 13:42 - Updated: 2026-08-25 14:28

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Moderate

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: capstone: * capstone-5.0.8-0.3.hum1 (aarch64, x86_64) * capstone-devel-5.0.8-0.3.hum1 (aarch64, x86_64) * capstone-java-5.0.8-0.3.hum1 (noarch) * capstone-static-5.0.8-0.3.hum1 (aarch64, x86_64) * python3-capstone-5.0.8-0.3.hum1 (noarch) * capstone-5.0.8-0.3.hum1.src (src) Security Fix(es): capstone: * CVE-2026-55893 * CVE-2026-55894

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-55893

A flaw was found in Capstone, a disassembly framework. The SH floating-point decoders in `arch/SH/SHDisassembler.c` do not correctly validate the size of the `operands[]` array when processing certain instructions. This vulnerability allows a local attacker to provide specially crafted SH2A FPU bytecode, leading to a heap buffer overflow. Successful exploitation can cause the application to crash, resulting in a Denial of Service (DoS), and may potentially enable arbitrary code execution.

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-805 - Buffer Access with Incorrect Length Value

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:capstone-main@aarch64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:capstone-main@noarch	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:capstone-main@src	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:capstone-main@x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-55894

A flaw was found in Capstone, a disassembly framework. The `sh_disassemble()` function incorrectly processes 16-bit instructions, leading to an attempt to read data from an unauthorized memory location (an out-of-bounds read). A remote attacker could exploit this by providing specially crafted bytecode to an application using Capstone in specific modes (SH2A or SH4A with SHFPU). This could cause the application to crash, resulting in a Denial of Service (DoS), where the service becomes unavailable. No code execution or information disclosure was demonstrated as a result of this flaw.

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:capstone-main@aarch64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:capstone-main@noarch	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:capstone-main@src	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:capstone-main@x86_64	—	Vendor Fix fix

Threats

Impact Moderate

References

21 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:59419	self
https://access.redhat.com/security/cve/CVE-2026-55893	external
https://access.redhat.com/security/cve/CVE-2026-55894	external
https://access.redhat.com/security/updates/classi…	external
https://images.redhat.com/	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-55893	self
https://bugzilla.redhat.com/show_bug.cgi?id=2520815	external
https://www.cve.org/CVERecord?id=CVE-2026-55893	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55893	external
https://github.com/capstone-engine/capstone/commi…	external
https://github.com/capstone-engine/capstone/commi…	external
https://github.com/capstone-engine/capstone/pull/2968	external
https://github.com/capstone-engine/capstone/pull/2969	external
https://github.com/capstone-engine/capstone/relea…	external
https://github.com/capstone-engine/capstone/secur…	external
https://access.redhat.com/security/cve/CVE-2026-55894	self
https://bugzilla.redhat.com/show_bug.cgi?id=2520820	external
https://www.cve.org/CVERecord?id=CVE-2026-55894	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55894	external
https://github.com/capstone-engine/capstone/secur…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ncapstone:\n  * capstone-5.0.8-0.3.hum1 (aarch64, x86_64)\n  * capstone-devel-5.0.8-0.3.hum1 (aarch64, x86_64)\n  * capstone-java-5.0.8-0.3.hum1 (noarch)\n  * capstone-static-5.0.8-0.3.hum1 (aarch64, x86_64)\n  * python3-capstone-5.0.8-0.3.hum1 (noarch)\n  * capstone-5.0.8-0.3.hum1.src (src)\n\nSecurity Fix(es):\n\ncapstone:\n  * CVE-2026-55893\n  * CVE-2026-55894",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:59419",
        "url": "https://access.redhat.com/errata/RHSA-2026:59419"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-55893",
        "url": "https://access.redhat.com/security/cve/CVE-2026-55893"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-55894",
        "url": "https://access.redhat.com/security/cve/CVE-2026-55894"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59419.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-08-25T14:28:42+00:00",
      "generator": {
        "date": "2026-08-25T14:28:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:59419",
      "initial_release_date": "2026-08-25T13:42:15+00:00",
      "revision_history": [
        {
          "date": "2026-08-25T13:42:15+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-25T13:44:22+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-25T14:28:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "capstone-main@aarch64",
                "product": {
                  "name": "capstone-main@aarch64",
                  "product_id": "capstone-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/capstone@5.0.8-0.3.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "capstone-main@src",
                "product": {
                  "name": "capstone-main@src",
                  "product_id": "capstone-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/capstone@5.0.8-0.3.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "capstone-main@x86_64",
                "product": {
                  "name": "capstone-main@x86_64",
                  "product_id": "capstone-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/capstone@5.0.8-0.3.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "capstone-main@noarch",
                "product": {
                  "name": "capstone-main@noarch",
                  "product_id": "capstone-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/capstone-java@5.0.8-0.3.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "capstone-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:capstone-main@aarch64"
        },
        "product_reference": "capstone-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "capstone-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:capstone-main@noarch"
        },
        "product_reference": "capstone-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "capstone-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:capstone-main@src"
        },
        "product_reference": "capstone-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "capstone-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:capstone-main@x86_64"
        },
        "product_reference": "capstone-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-55893",
      "cwe": {
        "id": "CWE-805",
        "name": "Buffer Access with Incorrect Length Value"
      },
      "discovery_date": "2026-08-20T21:50:58.983603+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2520815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Capstone, a disassembly framework. The SH floating-point decoders in `arch/SH/SHDisassembler.c` do not correctly validate the size of the `operands[]` array when processing certain instructions. This vulnerability allows a local attacker to provide specially crafted SH2A FPU bytecode, leading to a heap buffer overflow. Successful exploitation can cause the application to crash, resulting in a Denial of Service (DoS), and may potentially enable arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "capstone: Capstone: Heap buffer overflow with potential code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:capstone-main@aarch64",
          "Red Hat Hardened Images:capstone-main@noarch",
          "Red Hat Hardened Images:capstone-main@src",
          "Red Hat Hardened Images:capstone-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55893"
        },
        {
          "category": "external",
          "summary": "RHBZ#2520815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55893",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55893"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55893",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55893"
        },
        {
          "category": "external",
          "summary": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
          "url": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e"
        },
        {
          "category": "external",
          "summary": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed",
          "url": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed"
        },
        {
          "category": "external",
          "summary": "https://github.com/capstone-engine/capstone/pull/2968",
          "url": "https://github.com/capstone-engine/capstone/pull/2968"
        },
        {
          "category": "external",
          "summary": "https://github.com/capstone-engine/capstone/pull/2969",
          "url": "https://github.com/capstone-engine/capstone/pull/2969"
        },
        {
          "category": "external",
          "summary": "https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10",
          "url": "https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10"
        },
        {
          "category": "external",
          "summary": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-3hpv-wr3j-rxwh",
          "url": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-3hpv-wr3j-rxwh"
        }
      ],
      "release_date": "2026-08-20T21:32:46.718000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T13:42:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:capstone-main@aarch64",
            "Red Hat Hardened Images:capstone-main@noarch",
            "Red Hat Hardened Images:capstone-main@src",
            "Red Hat Hardened Images:capstone-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59419"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:capstone-main@aarch64",
            "Red Hat Hardened Images:capstone-main@noarch",
            "Red Hat Hardened Images:capstone-main@src",
            "Red Hat Hardened Images:capstone-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "capstone: Capstone: Heap buffer overflow with potential code execution"
    },
    {
      "cve": "CVE-2026-55894",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-08-20T21:51:24.348253+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2520820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Capstone, a disassembly framework. The `sh_disassemble()` function incorrectly processes 16-bit instructions, leading to an attempt to read data from an unauthorized memory location (an out-of-bounds read). A remote attacker could exploit this by providing specially crafted bytecode to an application using Capstone in specific modes (SH2A or SH4A with SHFPU). This could cause the application to crash, resulting in a Denial of Service (DoS), where the service becomes unavailable. No code execution or information disclosure was demonstrated as a result of this flaw.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "capstone: Capstone: Denial of Service via crafted SH2A bytecode",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in Capstone\u0027s SH disassembler can lead to a denial of service. An application processing specially crafted SH2A or SH4A bytecode with Capstone configured for these specific modes may crash due to an out-of-bounds read. This issue does not result in code execution or information disclosure, limiting its severity to service disruption.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:capstone-main@aarch64",
          "Red Hat Hardened Images:capstone-main@noarch",
          "Red Hat Hardened Images:capstone-main@src",
          "Red Hat Hardened Images:capstone-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55894"
        },
        {
          "category": "external",
          "summary": "RHBZ#2520820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55894",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55894"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55894",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55894"
        },
        {
          "category": "external",
          "summary": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
          "url": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e"
        },
        {
          "category": "external",
          "summary": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed",
          "url": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed"
        },
        {
          "category": "external",
          "summary": "https://github.com/capstone-engine/capstone/pull/2968",
          "url": "https://github.com/capstone-engine/capstone/pull/2968"
        },
        {
          "category": "external",
          "summary": "https://github.com/capstone-engine/capstone/pull/2969",
          "url": "https://github.com/capstone-engine/capstone/pull/2969"
        },
        {
          "category": "external",
          "summary": "https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10",
          "url": "https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10"
        },
        {
          "category": "external",
          "summary": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-gf2c-xwcp-hvf4",
          "url": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-gf2c-xwcp-hvf4"
        }
      ],
      "release_date": "2026-08-20T21:31:37.680000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T13:42:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:capstone-main@aarch64",
            "Red Hat Hardened Images:capstone-main@noarch",
            "Red Hat Hardened Images:capstone-main@src",
            "Red Hat Hardened Images:capstone-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59419"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:capstone-main@aarch64",
            "Red Hat Hardened Images:capstone-main@noarch",
            "Red Hat Hardened Images:capstone-main@src",
            "Red Hat Hardened Images:capstone-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "capstone: Capstone: Denial of Service via crafted SH2A bytecode"
    }
  ]
}

CVE-2026-55893 (GCVE-0-2026-55893)

Vulnerability from cvelistv5 – Published: 2026-08-20 21:32 – Updated: 2026-08-21 21:45

Title

Capstone SH disassembler `set_reg_n` heap buffer overflow via crafted SH2A FPU bytecode

Summary

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call set_reg() and set_reg_n() using sh_info.op.op_count without checking the fixed-size operands[] array. Repeated crafted instructions processed through cs_disasm_iter() or cs_disasm() with CS_ARCH_SH, CS_MODE_SH2A or CS_MODE_SH4A, CS_MODE_SHFPU, and CS_OPT_DETAIL can increment the operand count beyond the 176-byte sh_info allocation and perform a four-byte heap buffer overflow write. The corruption can crash the process and may enable code execution depending on heap layout. This issue is fixed in version 6.0.0-Alpha10.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 21:00 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/capstone-engine/capstone/secur…	x_refsource_CONFIRM
https://github.com/capstone-engine/capstone/pull/2968	x_refsource_MISC
https://github.com/capstone-engine/capstone/pull/2969	x_refsource_MISC
https://github.com/capstone-engine/capstone/commi…	x_refsource_MISC
https://github.com/capstone-engine/capstone/commi…	x_refsource_MISC
https://github.com/capstone-engine/capstone/relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
capstone-engine	capstone	Affected: < 6.0.0-Alpha10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55893",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T21:00:22.370190Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T21:45:29.340Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "capstone",
          "vendor": "capstone-engine",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.0.0-Alpha10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone\u0027s arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call set_reg() and set_reg_n() using sh_info.op.op_count without checking the fixed-size operands[] array. Repeated crafted instructions processed through cs_disasm_iter() or cs_disasm() with CS_ARCH_SH, CS_MODE_SH2A or CS_MODE_SH4A, CS_MODE_SHFPU, and CS_OPT_DETAIL can increment the operand count beyond the 176-byte sh_info allocation and perform a four-byte heap buffer overflow write. The corruption can crash the process and may enable code execution depending on heap layout. This issue is fixed in version 6.0.0-Alpha10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T21:32:46.718Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-3hpv-wr3j-rxwh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-3hpv-wr3j-rxwh"
        },
        {
          "name": "https://github.com/capstone-engine/capstone/pull/2968",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/capstone-engine/capstone/pull/2968"
        },
        {
          "name": "https://github.com/capstone-engine/capstone/pull/2969",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/capstone-engine/capstone/pull/2969"
        },
        {
          "name": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e"
        },
        {
          "name": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed"
        },
        {
          "name": "https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10"
        }
      ],
      "source": {
        "advisory": "GHSA-3hpv-wr3j-rxwh",
        "discovery": "UNKNOWN"
      },
      "title": "Capstone SH disassembler `set_reg_n` heap buffer overflow via crafted SH2A FPU bytecode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55893",
    "datePublished": "2026-08-20T21:32:46.718Z",
    "dateReserved": "2026-06-17T16:59:42.760Z",
    "dateUpdated": "2026-08-21T21:45:29.340Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55894 (GCVE-0-2026-55894)

Vulnerability from cvelistv5 – Published: 2026-08-20 21:31 – Updated: 2026-08-21 15:00

Title

Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode

Summary

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table. An application using CS_ARCH_SH with CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU can pass crafted bytecode through cs_disasm_iter() or cs_disasm(), causing the decode[idx] test to read outside the table and terminate the process with a segmentation fault. No code execution or information disclosure was demonstrated. This issue is fixed in version 6.0.0-Alpha10.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 14:59 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/capstone-engine/capstone/secur…	x_refsource_CONFIRM
https://github.com/capstone-engine/capstone/pull/2968	x_refsource_MISC
https://github.com/capstone-engine/capstone/pull/2969	x_refsource_MISC
https://github.com/capstone-engine/capstone/commi…	x_refsource_MISC
https://github.com/capstone-engine/capstone/commi…	x_refsource_MISC
https://github.com/capstone-engine/capstone/relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
capstone-engine	capstone	Affected: < 6.0.0-Alpha10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55894",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T14:59:57.566989Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T15:00:05.011Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-gf2c-xwcp-hvf4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "capstone",
          "vendor": "capstone-engine",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.0.0-Alpha10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone\u0027s arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table. An application using CS_ARCH_SH with CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU can pass crafted bytecode through cs_disasm_iter() or cs_disasm(), causing the decode[idx] test to read outside the table and terminate the process with a segmentation fault. No code execution or information disclosure was demonstrated. This issue is fixed in version 6.0.0-Alpha10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T21:31:37.680Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-gf2c-xwcp-hvf4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/capstone-engine/capstone/security/advisories/GHSA-gf2c-xwcp-hvf4"
        },
        {
          "name": "https://github.com/capstone-engine/capstone/pull/2968",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/capstone-engine/capstone/pull/2968"
        },
        {
          "name": "https://github.com/capstone-engine/capstone/pull/2969",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/capstone-engine/capstone/pull/2969"
        },
        {
          "name": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e"
        },
        {
          "name": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed"
        },
        {
          "name": "https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10"
        }
      ],
      "source": {
        "advisory": "GHSA-gf2c-xwcp-hvf4",
        "discovery": "UNKNOWN"
      },
      "title": "Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55894",
    "datePublished": "2026-08-20T21:31:37.680Z",
    "dateReserved": "2026-06-17T16:59:42.760Z",
    "dateUpdated": "2026-08-21T15:00:05.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:59419

CVE-2026-55893 (GCVE-0-2026-55893)

CVE-2026-55894 (GCVE-0-2026-55894)

Tags

Sightings

Nomenclature