# CVE-2026-47143: Capstone Engine NULL pointer dereference in X86 reduced builds

Source: https://junglewise.ai/threats/cve-2026-47143-capstone-engine-null-pointer-dereference-in-x86-reduced-builds  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-47143 · Severity: medium · CVSS 5.1 · Published 2026-07-21

Capstone is a widely used disassembly framework that translates machine code into human-readable assembly. A vulnerability exists in specific versions of the library when it is compiled with size-reduction optimizations, allowing a specially crafted file to cause the application using Capstone to crash. This could lead to a denial-of-service in security tools, malware analysis pipelines, or even system-wide crashes if the library is used within a computer's kernel.

Technologies: [Capstone Engine Capstone](https://junglewise.ai/threats/technologies/capstone), [capstone (PyPI)](https://junglewise.ai/threats/technologies/pypi-capstone). Vendors: [Capstone Engine](https://junglewise.ai/threats/vendors/capstone-engine), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-47143 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47143 being exploited in the wild.

**How severe is CVE-2026-47143?** Medium severity, with a CVSS score of 5.1, published 21 July 2026.

**Which products and versions are affected?** Capstone Engine Capstone < 5.0.8, < 6.0.0-Alpha8; capstone (PyPI) ECOSYSTEM:introduced=0,fixed=5.0.8.

**Is there a fix for CVE-2026-47143?** Yes. capstone (PyPI): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47143 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-47143?** Check whether you run Capstone Engine Capstone or capstone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- capstone (PyPI): upgrade to 5.0.8 or later

  ```sh
  pip install "capstone>=5.0.8"
  ```


## Technical details

A NULL pointer dereference exists in the `modRMRequired()` and `decode()` functions within `arch/X86/X86DisassemblerDecoder.c`. The vulnerability is triggered when the library is compiled with `-DCAPSTONE_X86_REDUCE=ON`. In this configuration, the `readOpcode()` function correctly identifies 3DNow! opcodes (0F 0F) and sets the instruction type to `THREEDNOW_MAP`, but the subsequent decoding logic for this map is incorrectly guarded by preprocessor directives. This results in an uninitialized `indextable` or `dec` pointer being dereferenced. An attacker can trigger a crash by providing a 4-byte sequence (`0F 0F <modrm> <imm8>`) to the `cs_disasm` function. The issue is resolved in versions 5.0.8 and 6.0.0-Alpha8.

## Affected products

- Capstone Engine Capstone < 5.0.8, < 6.0.0-Alpha8

## Identifiers

- CVE-2026-47143
- PYSEC-2026-3544

## Timeline

- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-05-19: patched: Fix merged into v5 and v6 branches
- 2026-05-23: patched: Version 5.0.8 released
- 2026-07-21: disclosed: CVE-2026-47143 published to NVD

## References

- [https://github.com/capstone-engine/capstone/commit/a0201371719b5aaa91d318ab2898843718f92d1f](https://github.com/capstone-engine/capstone/commit/a0201371719b5aaa91d318ab2898843718f92d1f)
- [https://github.com/capstone-engine/capstone/commit/fab595205fee206f5c21be6ed8ad2eaf9225f1c7](https://github.com/capstone-engine/capstone/commit/fab595205fee206f5c21be6ed8ad2eaf9225f1c7)
- [https://github.com/capstone-engine/capstone/pull/2924](https://github.com/capstone-engine/capstone/pull/2924)
- [https://github.com/capstone-engine/capstone/security/advisories/GHSA-289w-cm54-fgrm](https://github.com/capstone-engine/capstone/security/advisories/GHSA-289w-cm54-fgrm)

## Related threats

- [Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in…](https://junglewise.ai/threats/cve-2025-68114-capstone-is-a-disassembly-framework-in-versions-6-0-0-alpha5-and)
- [Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a…](https://junglewise.ai/threats/cve-2025-67873-capstone-is-a-disassembly-framework-in-versions-6-0-0-alpha5-and)
- [PYSEC-2019-242 - Capstone 3.0.4 has an out-of-bounds vulnerability (SEGV caused by a read memory access) in X86_insn_reg_intel in arch/X86/X86Mapping.c.](https://junglewise.ai/threats/cve-2016-7151-capstone-segv-caused-by-a-read-memory-access)
- [Capstone Integer overflow](https://junglewise.ai/threats/cve-2017-6952-capstone-integer-overflow)