CVE-2026-55894 Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode
Crafted SH2A bytecode causes an out-of-bounds read in the Capstone SH disassembler, leading to a segmentation fault and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55894?
CVE-2026-55894 is a medium-severity denial of service vulnerability in capstone-engine capstone, published on 20 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table. An application using CS_ARCH_SH with CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU can pass crafted bytecode through cs_disasm_iter() or cs_disasm(), causing the decode[idx] test to read outside the table and terminate the process with a segmentation fault. No code execution or information disclosure was demonstrated. This issue is fixed in version 6.0.0-Alpha10.
Weakness: CWE-125
Which versions are affected by CVE-2026-55894?
How do I fix CVE-2026-55894?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-55894 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55894 exists.
Sources
Also known as AZL-96891, AZL-97413, BELL-CVE-2026-55894, DEBIAN-CVE-2026-55894, GHSA-gf2c-xwcp-hvf4, UBUNTU-CVE-2026-55894.