{"id":"CVE-2026-55894","summary":"Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode","details":"Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table. An application using CS_ARCH_SH with CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU can pass crafted bytecode through cs_disasm_iter() or cs_disasm(), causing the decode[idx] test to read outside the table and terminate the process with a segmentation fault. No code execution or information disclosure was demonstrated. This issue is fixed in version 6.0.0-Alpha10.","aliases":["GHSA-gf2c-xwcp-hvf4"],"modified":"2026-08-22T09:15:54.824596Z","published":"2026-08-20T21:31:37.680Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55894.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-125"]},"references":[{"type":"WEB","url":"https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55894.json"},{"type":"ADVISORY","url":"https://github.com/capstone-engine/capstone/security/advisories/GHSA-gf2c-xwcp-hvf4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55894"},{"type":"FIX","url":"https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e"},{"type":"FIX","url":"https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed"},{"type":"FIX","url":"https://github.com/capstone-engine/capstone/pull/2968"},{"type":"FIX","url":"https://github.com/capstone-engine/capstone/pull/2969"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/capstone-engine/capstone","events":[{"introduced":"0"},{"fixed":"09e76802380b9e94d9720c44458d9d5282219e7e"},{"fixed":"e17ee44a8307ea33375b4727ac4f987650bf7bed"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"6.0.0-Alpha10"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["5.0.9","6.0.0-Alpha9","5.0.8","6.0.0-Alpha8","5.0.7","6.0.0-Alpha7","6.0.0-Alpha6","5.0.6","6.0.0-Alpha5","6.0.0-Alpha4","6.0.0-Alpha3","5.0.5","5.0.4","5.0.3","5.0.2","5.0.1","5.0-rc4","5.0-rc3","5.0-rc2","5.0-rc1","4.0-alpha5","4.0-alpha4","4.0-alpha3","4.0-alpha2","4.0-alpha1","3.0-rc3","3.0-rc2","3.0-rc1","2.1","2.0","2.0-rc1","1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55894.json","vanir_signatures_modified":"2026-08-22T09:15:54Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"111621750072723809347341125391406727264","length":463},"id":"CVE-2026-55894-1c5fd500","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed","target":{"function":"opMOV_rind","file":"arch/SH/SHDisassembler.c"}},{"deprecated":false,"digest":{"function_hash":"208058099951435225158930433934993572899","length":778},"id":"CVE-2026-55894-1cc37508","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed","target":{"file":"arch/SH/SHDisassembler.c","function":"set_mem_n"}},{"digest":{"function_hash":"245580544992383184281023978705159020663","length":185},"id":"CVE-2026-55894-375792be","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e","target":{"file":"arch/SH/SHDisassembler.c","function":"set_reg"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e","target":{"function":"op4xxb","file":"arch/SH/SHDisassembler.c"},"deprecated":false,"digest":{"function_hash":"335444738187917447247733973622325853441","length":1756},"id":"CVE-2026-55894-4a9ef06a","signature_type":"Function"},{"id":"CVE-2026-55894-53386370","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e","target":{"file":"arch/SH/SHDisassembler.c","function":"opMOV_BW_dsp"},"deprecated":false,"digest":{"function_hash":"282879095551101401766817839454973258158","length":507}},{"target":{"file":"tests/integration/test_poc.c","function":"main"},"deprecated":false,"digest":{"function_hash":"60581121344323394982684846690472597602","length":63},"id":"CVE-2026-55894-56317aa0","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e"},{"digest":{"function_hash":"131655530364642469674223518597885502056","length":229},"id":"CVE-2026-55894-6600eb32","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed","target":{"file":"arch/SH/SHDisassembler.c","function":"set_mem"},"deprecated":false},{"source":"https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed","target":{"file":"arch/SH/SHDisassembler.c","function":"set_reg_n"},"deprecated":false,"digest":{"function_hash":"203561472378139921459965054994187227438","length":243},"id":"CVE-2026-55894-68b9d80a","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"131655530364642469674223518597885502056","length":229},"id":"CVE-2026-55894-788f89cc","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e","target":{"file":"arch/SH/SHDisassembler.c","function":"set_mem"}},{"digest":{"line_hashes":["56681790147492349595328234047966935599","298084201049342381613159388341196995820","90277616625833746295729598954723929832","271591085299199007001640275329933269544","169103068490501063730588007688891148204","262916325913926881832611111089645264000"],"threshold":0.9},"id":"CVE-2026-55894-82aed326","signature_type":"Line","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e","target":{"file":"tests/integration/test_poc.c"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed","target":{"file":"arch/SH/SHDisassembler.c","function":"sh_disassemble"},"deprecated":false,"digest":{"function_hash":"112994267864934544459834941867444849556","length":1560},"id":"CVE-2026-55894-8622263a"},{"target":{"file":"arch/SH/SHDisassembler.c"},"deprecated":false,"digest":{"line_hashes":["97550690778504212196682144321503735696","130803129017180827214580273675484486004","138838081369681749869030457252729936051","247835972454535981406350425289403460081","293899838517004412071926869816659593741","157291195502530201525107257558167395977","120666967994025705272779178623516289776","100936572138949324841131051362514701","87514018156856684377609402163719430573","116275769031055623692104003502941459604","293617064405114722609218710965456939030","85286952801048811852504966338507645197","102558535547059923131188712413106791150","57666779477811814250444556534629781485","212512629981815889159596399116592728933","309456904552599226064907178835913711955","202307328750901692381345412133678381152","276662566221026512616827708221505570207","270374065965792188794215669391376627436","140010709814199722806207979940131620919","149954327677934168499907570337221087","88988598075187230386828591238582976424","95942363800685116240043899357971875441","278421004904408571607488246103357428521","177675013372981908946634110975095310900","260912625565500179117486721883005782140","275489396545161715156769898077644486306","198841576822439209287035877701875685189","25065623801440579918577069298432043209","295424583566066879467334962613146807183","211684568181461391035184951726402258516","46685258013375012841686643273935380717","181004434837034993790203037818549089032","28693936378871532409800986205863907144","224438518003410419113964230205993261874","213857051892733519691879825088840801606","322994768754203312901110661398313211882","162641685670950410053363749145851398682","7193587451508942624739951259097820837","69436993729531430886451513791936615301","79063577261539846510632771701254374024","163170202356517486343032669937656791732","228294428292904100685351278592241478441","68832951775927631619227834852006521634","168284854989703351947416934440260150146","300245923175808976896013293789265246876","114446661333012723385645210707170472139","120461527008804588554636494256739200897","161078168383579574881383145830226805023","302509794609374560073301687998066833797","35974507107628124256811272493868373219","10803255704879185201872619090450796887","300245923175808976896013293789265246876","114446661333012723385645210707170472139","5542981775006699264271729725470130212","40379959555609388686238447808429140233","289893107230583288326992723067585814618","227204709489460750060670334555357751948","198712940500799729655972705359308668225","72290405273968857376847039313514476363","268153692801004659795029733389079441225","110684617342857992027859222441648392162","311911910497378128982953012907101926999","208776306728530628151156056110713250043","59283537226134191769393164335350362906","84269844450425987657582965054109002922","77983467619195106735243028575373708321","242676822444625188663446902797617827985","138114114663194251783993066781969375887","220802706246091501928246843493349349254","163015328066292325067972078330532722022","311165807396934671974788471133328016520","70741974830826213721940033261674796246","260062557830108351357564797505357466748","242676822444625188663446902797617827985","51783150396799362992814862280240394686","54564026883098046631408215461741659647","144022630374248897287269002647143520922","187460134033463982672553296836738719974","291456661093819079037700118809882855656","161334864720222522098391320080146080796","184282637838069876326357617211038566922","43657582335184883980040793487434836347","107431030738899280732939649049253815823","181009696756719497807123875121915285842","327656452989591119577254751229786433605"],"threshold":0.9},"id":"CVE-2026-55894-8c67751a","signature_type":"Line","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e"},{"target":{"file":"arch/SH/SHDisassembler.c","function":"set_reg_n"},"deprecated":false,"digest":{"function_hash":"203561472378139921459965054994187227438","length":243},"id":"CVE-2026-55894-af6eb4be","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e"},{"target":{"file":"arch/SH/SHDisassembler.c","function":"op4xxb"},"deprecated":false,"digest":{"function_hash":"100217292965289654423600218360889076667","length":1741},"id":"CVE-2026-55894-b6b5bfb8","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed"},{"id":"CVE-2026-55894-b7a9220d","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e","target":{"file":"arch/SH/SHDisassembler.c","function":"set_mem_n"},"deprecated":false,"digest":{"function_hash":"208058099951435225158930433934993572899","length":778}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e","target":{"file":"arch/SH/SHDisassembler.c","function":"sh_disassemble"},"deprecated":false,"digest":{"function_hash":"164800201630503314454414320027777151069","length":1589},"id":"CVE-2026-55894-ba033395"},{"deprecated":false,"digest":{"function_hash":"21950857795304117040334495707286305560","length":824},"id":"CVE-2026-55894-bc2b134b","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e","target":{"file":"arch/SH/SHDisassembler.c","function":"opMOVx"}},{"signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed","target":{"file":"arch/SH/SHDisassembler.c"},"deprecated":false,"digest":{"line_hashes":["239805492558515764723725372283471515101","130803129017180827214580273675484486004","138838081369681749869030457252729936051","247835972454535981406350425289403460081","278265399590353839814762220341864853410","157291195502530201525107257558167395977","120666967994025705272779178623516289776","100936572138949324841131051362514701","87514018156856684377609402163719430573","116275769031055623692104003502941459604","293617064405114722609218710965456939030","85286952801048811852504966338507645197","102558535547059923131188712413106791150","144997807292818477385256546450441320520","253412802228259458304891017871474947092","138136232967112531358900283363602259825","142284960593371967867469005469598099614","226469243488259421738616311538183527958","189471832993193025457374421876645620345","270374065965792188794215669391376627436","140010709814199722806207979940131620919","149954327677934168499907570337221087","196921488189038071948860272047761759327","95942363800685116240043899357971875441","278421004904408571607488246103357428521","177675013372981908946634110975095310900","241048025276014268650759488214593359299","275489396545161715156769898077644486306","198841576822439209287035877701875685189","25065623801440579918577069298432043209","101700168589681985363480273136819034583","211684568181461391035184951726402258516","46685258013375012841686643273935380717","181004434837034993790203037818549089032","175676119402902806729468101776446300279","224438518003410419113964230205993261874","213857051892733519691879825088840801606","195064637925743973914298309338864859085","162641685670950410053363749145851398682","7193587451508942624739951259097820837","69436993729531430886451513791936615301","229343484353203078727404711647174919314","55820854580302120414109801543558268626","228294428292904100685351278592241478441","68832951775927631619227834852006521634","168284854989703351947416934440260150146","266549093774239509899111381167269693930","114446661333012723385645210707170472139","120461527008804588554636494256739200897","290523632450858786077939545885108160840","302509794609374560073301687998066833797","35974507107628124256811272493868373219","10803255704879185201872619090450796887","50222300351181377616125323515088015681","114446661333012723385645210707170472139","5542981775006699264271729725470130212","40379959555609388686238447808429140233","289893107230583288326992723067585814618","59010863419397613171305540848956772915","198712940500799729655972705359308668225","72290405273968857376847039313514476363","268153692801004659795029733389079441225","114022158715413068840118613502381985976","197629636430649751690705949930201145757","208776306728530628151156056110713250043","59283537226134191769393164335350362906","84269844450425987657582965054109002922","90002922949594180242868930673450276687","242676822444625188663446902797617827985","138114114663194251783993066781969375887","199353566821766145495729133203332817080","163015328066292325067972078330532722022","311165807396934671974788471133328016520","70741974830826213721940033261674796246","77983467619195106735243028575373708321","242676822444625188663446902797617827985","51783150396799362992814862280240394686","54564026883098046631408215461741659647","144022630374248897287269002647143520922","187460134033463982672553296836738719974","291456661093819079037700118809882855656","161334864720222522098391320080146080796","184282637838069876326357617211038566922","43657582335184883980040793487434836347","293231198073022181645541690059805104222","249685555468530349182068263002986660080","59093474781337102843412182585074054112"],"threshold":0.9},"id":"CVE-2026-55894-bcd13ab0","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"154671398753303063859898133976958703100","length":452},"id":"CVE-2026-55894-bd172cfa","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e","target":{"file":"arch/SH/SHDisassembler.c","function":"opMOV_L_dsp"}},{"deprecated":false,"digest":{"length":824,"function_hash":"21950857795304117040334495707286305560"},"id":"CVE-2026-55894-d4b30d02","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed","target":{"file":"arch/SH/SHDisassembler.c","function":"opMOVx"}},{"source":"https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed","target":{"file":"arch/SH/SHDisassembler.c","function":"opMOV_L_dsp"},"deprecated":false,"digest":{"function_hash":"154671398753303063859898133976958703100","length":452},"id":"CVE-2026-55894-e3be83c5","signature_type":"Function","signature_version":"v1"},{"target":{"function":"opMOV_rind","file":"arch/SH/SHDisassembler.c"},"deprecated":false,"digest":{"function_hash":"111621750072723809347341125391406727264","length":463},"id":"CVE-2026-55894-e452f5c4","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e"},{"deprecated":false,"digest":{"length":185,"function_hash":"245580544992383184281023978705159020663"},"id":"CVE-2026-55894-e785f853","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed","target":{"file":"arch/SH/SHDisassembler.c","function":"set_reg"}},{"id":"CVE-2026-55894-f7bbe132","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed","target":{"file":"arch/SH/SHDisassembler.c","function":"opMOV_BW_dsp"},"deprecated":false,"digest":{"function_hash":"282879095551101401766817839454973258158","length":507}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}