redhat/capstone vulnerabilities

Latest redhat/capstone CVEs

Newest publication first

1. CVE-2026-55893 Capstone SH disassembler `set_reg_n` heap buffer overflow via crafted SH2A FPU bytecode

   Published 2026-08-20

   High·CVSS 7.3 EPSS 0.19%

   Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call set_reg() and set_reg_n() using sh_info.op.op_count without checking the fixed-size operands[] array. Repeated...

2. CVE-2026-55894 Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode

   Published 2026-08-20

   Medium·CVSS 6.8 EPSS 0.19%

   Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table. An applicati...

3. CVE-2026-49263 Capstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronization

   Published 2026-08-14

   Low·CVSS 2.0 EPSS 0.17%

   Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public cs_disasm() and cs_disasm_iter() APIs. For a large but well-formed br_table instruction, the WASM decoder a...

4. CVE-2026-49282 Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes

   Published 2026-08-14

   Medium·CVSS 5.1 EPSS 0.18%

   Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public cs_insn_name() API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and...

5. CVE-2026-47143 Capstone has a NULL Pointer Dereference with 3DNow! opcodes

   Published 2026-07-21

   Medium·CVSS 5.9 EPSS 0.47%

   Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in modRMRequired() and decode() when disassembling 3DNow! opcodes (0F 0F) in builds compiled with -DCAPSTONE_X86_REDUCE, allowing a remote attacker to crash any applicati...

6. CVE-2025-68114 Capstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflow

   Published 2025-12-17

   Critical·CVSS 9.8 EPSS 0.20%

   Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs....

7. CVE-2025-67873 Capstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflow

   Published 2025-12-17

   High·CVSS 7.8 EPSS 0.23%

   Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly p...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.