{"id":"CVE-2026-55893","aliases":["GHSA-3hpv-wr3j-rxwh"],"url":"https://o3.security/vulnerability/CVE-2026-55893","summary":"Capstone SH disassembler `set_reg_n` heap buffer overflow via crafted SH2A FPU bytecode","details":"Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call set_reg() and set_reg_n() using sh_info.op.op_count without checking the fixed-size operands[] array. Repeated crafted instructions processed through cs_disasm_iter() or cs_disasm() with CS_ARCH_SH, CS_MODE_SH2A or CS_MODE_SH4A, CS_MODE_SHFPU, and CS_OPT_DETAIL can increment the operand count beyond the 176-byte sh_info allocation and perform a four-byte heap buffer overflow write. The corruption can crash the process and may enable code execution depending on heap layout. This issue is fixed in version 6.0.0-Alpha10.","published":"2026-08-20T21:32:46.718Z","modified":"2026-08-22T03:58:08.231136744Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e","label":"capstone-engine/capstone@09e7680"},"references":[{"type":"WEB","url":"https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55893.json"},{"type":"ADVISORY","url":"https://github.com/capstone-engine/capstone/security/advisories/GHSA-3hpv-wr3j-rxwh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55893"},{"type":"FIX","url":"https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e"},{"type":"FIX","url":"https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed"},{"type":"FIX","url":"https://github.com/capstone-engine/capstone/pull/2968"},{"type":"FIX","url":"https://github.com/capstone-engine/capstone/pull/2969"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-22T03:58:08.231136744Z"}}