CVE-2026-47143: Capstone Engine NULL pointer dereference in X86 reduced builds

CVE-2026-47143 · Severity: medium · CVSS 5.1 · Published 2026-07-21

Capstone is a widely used disassembly framework that translates machine code into human-readable assembly. A vulnerability exists in specific versions of the library when it is compiled with size-reduction optimizations, allowing a specially crafted file to cause the application using Capstone to crash. This could lead to a denial-of-service in security tools, malware analysis pipelines, or even system-wide crashes if the library is used within a computer's kernel.

Technologies: Capstone Engine Capstone, capstone (PyPI). Vendors: Capstone Engine, PyPI.

Quick answers

Is CVE-2026-47143 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47143 being exploited in the wild.
How severe is CVE-2026-47143?
Medium severity, with a CVSS score of 5.1, published 21 July 2026.
Which products and versions are affected?
Capstone Engine Capstone < 5.0.8, < 6.0.0-Alpha8; capstone (PyPI) ECOSYSTEM:introduced=0,fixed=5.0.8.
Is there a fix for CVE-2026-47143?
Yes. capstone (PyPI): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47143 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-47143?
Check whether you run Capstone Engine Capstone or capstone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • capstone (PyPI): upgrade to 5.0.8 or later
    pip install "capstone>=5.0.8"

Technical details

A NULL pointer dereference exists in the `modRMRequired()` and `decode()` functions within `arch/X86/X86DisassemblerDecoder.c`. The vulnerability is triggered when the library is compiled with `-DCAPSTONE_X86_REDUCE=ON`. In this configuration, the `readOpcode()` function correctly identifies 3DNow! opcodes (0F 0F) and sets the instruction type to `THREEDNOW_MAP`, but the subsequent decoding logic for this map is incorrectly guarded by preprocessor directives. This results in an uninitialized `indextable` or `dec` pointer being dereferenced. An attacker can trigger a crash by providing a 4-byte sequence (`0F 0F <modrm> <imm8>`) to the `cs_disasm` function. The issue is resolved in versions 5.0.8 and 6.0.0-Alpha8.

Affected products

  • Capstone Engine Capstone < 5.0.8, < 6.0.0-Alpha8

Identifiers

  • CVE-2026-47143
  • PYSEC-2026-3544

Timeline

  • 2026-05-19: advisory: GitHub Security Advisory published
  • 2026-05-19: patched: Fix merged into v5 and v6 branches
  • 2026-05-23: patched: Version 5.0.8 released
  • 2026-07-21: disclosed: CVE-2026-47143 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.