CVE-2026-47143mediumCWE-476

CVE-2026-47143: medium-severity vulnerability in capstone-engine capstone

Capstone has a NULL Pointer Dereference with 3DNow! opcodes

Published · Updated

Follow this CVE+ Monitor capstone+ Monitor capstone

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.5%
Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with `-DCAPSTONE_X86_REDUCE`, allowing a remote attacker to crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence `0F 0F <modrm> <imm8>`. Versions 6.0.0-Alpha8 and 5.0.8 patch the issue.
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
capstone-engine · capstone
Related CVEs — capstone-engine capstone

In the same product, most dangerous first.

CVE-2025-67873MEDIUMCapstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflowEPSS 0.2%CVE-2025-68114MEDIUMCapstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflowEPSS 0.2%CVE-2026-55894MEDIUMCapstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecodeEPSS 0.2%CVE-2026-55893HIGHCapstone SH disassembler `set_reg_n` heap buffer overflow via crafted SH2A FPU bytecodeEPSS 0.2%CVE-2026-49282MEDIUMCapstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashesEPSS 0.2%CVE-2026-49263LOWCapstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronizationEPSS 0.2%