Junglewise Threat Intelligence

CVE-2026-47143: Capstone Engine NULL pointer dereference in X86 reduced builds

CVE-2026-47143 · Severity: medium · CVSS 5.1 · Published 2026-07-21

Technologies: Capstone Engine Capstone. Vendors: Capstone Engine, PyPI.

Executive brief

Capstone is a widely used disassembly framework that translates machine code into human-readable assembly. A vulnerability exists in specific versions of the library when it is compiled with size-reduction optimizations, allowing a specially crafted file to cause the application using Capstone to crash. This could lead to a denial-of-service in security tools, malware analysis pipelines, or even system-wide crashes if the library is used within a computer's kernel.

Technical details

A NULL pointer dereference exists in the `modRMRequired()` and `decode()` functions within `arch/X86/X86DisassemblerDecoder.c`. The vulnerability is triggered when the library is compiled with `-DCAPSTONE_X86_REDUCE=ON`. In this configuration, the `readOpcode()` function correctly identifies 3DNow! opcodes (0F 0F) and sets the instruction type to `THREEDNOW_MAP`, but the subsequent decoding logic for this map is incorrectly guarded by preprocessor directives. This results in an uninitialized `indextable` or `dec` pointer being dereferenced. An attacker can trigger a crash by providing a 4-byte sequence (`0F 0F <modrm> <imm8>`) to the `cs_disasm` function. The issue is resolved in versions 5.0.8 and 6.0.0-Alpha8.

Affected products

  • Capstone Engine Capstone < 5.0.8, < 6.0.0-Alpha8

Timeline

  • 2026-05-19: advisory: GitHub Security Advisory published
  • 2026-05-19: patched: Fix merged into v5 and v6 branches
  • 2026-05-23: patched: Version 5.0.8 released
  • 2026-07-21: disclosed: CVE-2026-47143 published to NVD

References

Related threats