{"id":"CVE-2026-47143","summary":"Capstone has a NULL Pointer Dereference with 3DNow! opcodes","details":"Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with `-DCAPSTONE_X86_REDUCE`, allowing a remote attacker to crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence `0F 0F \u003cmodrm\u003e \u003cimm8\u003e`. Versions 6.0.0-Alpha8 and 5.0.8 patch the issue.","aliases":["GHSA-289w-cm54-fgrm","PYSEC-2026-3544"],"modified":"2026-08-12T16:25:20.957810Z","published":"2026-07-21T20:10:44.476Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-476"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47143.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47143.json"},{"type":"ADVISORY","url":"https://github.com/capstone-engine/capstone/security/advisories/GHSA-289w-cm54-fgrm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47143"},{"type":"FIX","url":"https://github.com/capstone-engine/capstone/commit/a0201371719b5aaa91d318ab2898843718f92d1f"},{"type":"FIX","url":"https://github.com/capstone-engine/capstone/commit/fab595205fee206f5c21be6ed8ad2eaf9225f1c7"},{"type":"FIX","url":"https://github.com/capstone-engine/capstone/pull/2924"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/capstone-engine/capstone","events":[{"introduced":"0"},{"fixed":"13f1decbc9181770e9211edb188c14f0699a41b6"},{"introduced":"97db712c91e964718f9cc300e81b9cf76b31a22e"},{"fixed":"a0201371719b5aaa91d318ab2898843718f92d1f"},{"fixed":"fab595205fee206f5c21be6ed8ad2eaf9225f1c7"}],"database_specific":{"cpe":["cpe:2.3:a:capstone-engine:capstone:*:*:*:*:*:*:*:*","cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha1:*:*:*:*:*:*","cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha2:*:*:*:*:*:*","cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha3:*:*:*:*:*:*","cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha4:*:*:*:*:*:*","cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha5:*:*:*:*:*:*","cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha6:*:*:*:*:*:*","cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha7:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"5.0.8"},{"introduced":"6.0.0-alpha1"},{"last_affected":"6.0.0-alpha1"},{"introduced":"6.0.0-alpha2"},{"last_affected":"6.0.0-alpha2"},{"introduced":"6.0.0-alpha3"},{"last_affected":"6.0.0-alpha3"},{"introduced":"6.0.0-alpha4"},{"last_affected":"6.0.0-alpha4"},{"introduced":"6.0.0-alpha5"},{"last_affected":"6.0.0-alpha5"},{"introduced":"6.0.0-alpha6"},{"last_affected":"6.0.0-alpha6"},{"introduced":"6.0.0-alpha7"},{"last_affected":"6.0.0-alpha7"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["6.0.0-alpha1","6.0.0-alpha2","6.0.0-alpha3","6.0.0-alpha4","6.0.0-alpha5","6.0.0-alpha6","6.0.0-alpha7","5.0.7","6.0.0-Alpha7","6.0.0-Alpha6","5.0.6","6.0.0-Alpha5","6.0.0-Alpha4","6.0.0-Alpha3","5.0.5","5.0.4","5.0.3","5.0.2","5.0.1","5.0-rc4","5.0-rc3","5.0-rc2","5.0-rc1","4.0-alpha5","4.0-alpha4","4.0-alpha3","4.0-alpha2","4.0-alpha1","3.0-rc3","3.0-rc2","3.0-rc1","2.1","2.0","2.0-rc1","1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47143.json","vanir_signatures_modified":"2026-08-12T16:25:20Z","vanir_signatures":[{"digest":{"function_hash":"187000980055492675362382952457146936096","length":1023},"id":"CVE-2026-47143-2f03ffb0","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/fab595205fee206f5c21be6ed8ad2eaf9225f1c7","target":{"file":"arch/X86/X86DisassemblerDecoder.c","function":"modRMRequired"},"deprecated":false},{"target":{"file":"arch/X86/X86DisassemblerDecoder.c"},"deprecated":false,"digest":{"line_hashes":["94778517957781665053515591810238867091","315640415055638152841338594717765071733","190017271567173188141405328334183865340","264977558652581940474257248613091536775","158958293578589584497662362955995436712","315640415055638152841338594717765071733","242328571852912725477216165199820775953","189797111289931334381665302004980672373"],"threshold":0.9},"id":"CVE-2026-47143-42778c9b","signature_type":"Line","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/a0201371719b5aaa91d318ab2898843718f92d1f"},{"signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/a0201371719b5aaa91d318ab2898843718f92d1f","target":{"file":"arch/X86/X86DisassemblerDecoder.c","function":"decode"},"deprecated":false,"digest":{"length":2583,"function_hash":"217744392535184036845109868347300417273"},"id":"CVE-2026-47143-4ff71b69","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/fab595205fee206f5c21be6ed8ad2eaf9225f1c7","target":{"function":"decode","file":"arch/X86/X86DisassemblerDecoder.c"},"deprecated":false,"digest":{"function_hash":"217744392535184036845109868347300417273","length":2583},"id":"CVE-2026-47143-adcd83e2"},{"signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/a0201371719b5aaa91d318ab2898843718f92d1f","target":{"file":"arch/X86/X86DisassemblerDecoder.c","function":"modRMRequired"},"deprecated":false,"digest":{"function_hash":"187000980055492675362382952457146936096","length":1023},"id":"CVE-2026-47143-cd9cfb6b","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["276019457597561395120053698568353517563","299671640254857970179169801570903469472","47599592861809676067690421698111295416","279017597373175798263490084134430306997","43262349231205340952910347115529973599","81934444572908988959814022173545426255","14555207915684185867484329623291848601","104607537312763127902802323158010570087"],"threshold":0.9},"id":"CVE-2026-47143-f97f444d","signature_type":"Line","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/fab595205fee206f5c21be6ed8ad2eaf9225f1c7","target":{"file":"arch/X86/X86DisassemblerDecoder.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}