Medium severity5.1OSV Advisory· Published Jul 21, 2026· Updated Jul 30, 2026
CVE-2026-47143
CVE-2026-47143
Description
Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in modRMRequired() and decode() when disassembling 3DNow! opcodes (0F 0F) in builds compiled with -DCAPSTONE_X86_REDUCE, allowing a remote attacker to crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence 0F 0F . Versions 6.0.0-Alpha8 and 5.0.8 patch the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
105.0.7, 6.0.0-Alpha7, 6.0.0-Alpha6, …+ 9 more
- (no CPE)range: 5.0.7, 6.0.0-Alpha7, 6.0.0-Alpha6, …
- cpe:2.3:a:capstone-engine:capstone:*:*:*:*:*:*:*:*range: <5.0.8
- cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha4:*:*:*:*:*:*
- cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha5:*:*:*:*:*:*
- cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha6:*:*:*:*:*:*
- cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha7:*:*:*:*:*:*
- (no CPE)range: <6.0.0-Alpha8, <5.0.8
Patches
Vulnerability mechanics
References
4- github.com/capstone-engine/capstone/commit/a0201371719b5aaa91d318ab2898843718f92d1fnvdPatch
- github.com/capstone-engine/capstone/commit/fab595205fee206f5c21be6ed8ad2eaf9225f1c7nvdPatch
- github.com/capstone-engine/capstone/pull/2924nvdIssue TrackingPatch
- github.com/capstone-engine/capstone/security/advisories/GHSA-289w-cm54-fgrmnvdExploitVendor Advisory
News mentions
0No linked articles in our index yet.