CVE-2026-47143 Capstone has a NULL Pointer Dereference with 3DNow! opcodes
A remote attacker can crash applications using the reduced X86 Capstone library by supplying crafted 3DNow! opcodes, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47143?
CVE-2026-47143 is a medium-severity vulnerability in capstone-engine capstone, published on 21 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with `-DCAPSTONE_X86_REDUCE`, allowing a remote attacker to crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence `0F 0F <modrm> <imm8>`. Versions 6.0.0-Alpha8 and 5.0.8 patch the issue.
Weakness: CWE-476
Which versions are affected by CVE-2026-47143?
1 open source package ship an affected version, including capstone. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
capstone PyPI | All versions | 5.0.8 |
Linux distribution packages (5)
capstone Red Hat:hummingbird:1 | All versions | 0:5.0.8-0.1.hum1 |
capstone-devel Red Hat:hummingbird:1 | All versions | 0:5.0.8-0.1.hum1 |
capstone-java Red Hat:hummingbird:1 | All versions | 0:5.0.8-0.1.hum1 |
capstone-static Red Hat:hummingbird:1 | All versions | 0:5.0.8-0.1.hum1 |
python3-capstone Red Hat:hummingbird:1 | All versions | 0:5.0.8-0.1.hum1 |
Products include Capstone-Engine Capstone.
How do I fix CVE-2026-47143?
Upgrade capstone to 5.0.8 or later.
Is CVE-2026-47143 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47143 exists.
Other vulnerabilities in capstone-engine capstone
- CVE-2017-6952 Capstone Integer overflow
- CVE-2016-7151 Capstone SEGV caused by a read memory access
- CVE-2025-67873 Capstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflow
- CVE-2025-68114 Capstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflow
Sources
Also known as AZL-92879, AZL-93312, BELL-CVE-2026-47143, DEBIAN-CVE-2026-47143, GHSA-289w-cm54-fgrm, PYSEC-2026-3544 and 2 more.