VYPR
← All advisories
Unrated severityOSV Advisory· Published Jul 24, 2026

Debian capstone: Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 ha…

CVE-2026-47143

Description

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in modRMRequired() and decode() when disassembling 3DNow! opcodes (0F 0F) in builds compiled with -DCAPSTONE_X86_REDUCE, allowing a remote attacker to crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence 0F 0F . Versions 6.0.0-Alpha8 and 5.0.8 patch the issue.

Affected products

2
  • Capstone Engine/CapstoneOSV2 versions
    5.0.7, 6.0.0-Alpha7, 6.0.0-Alpha6, …+ 1 more
    • (no CPE)range: 5.0.7, 6.0.0-Alpha7, 6.0.0-Alpha6, …
    • (no CPE)range: <6.0.0-Alpha8, <5.0.8

Patches

Vulnerability mechanics

News mentions

0

No linked articles in our index yet.