Is CVE-2026-55893 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55893 being exploited in the wild.

How severe is CVE-2026-55893?

Informational severity, published 20 August 2026.

Which products and versions are affected?

Capstone Capstone 6.0.0-Alpha9 and earlier.

Is there a fix for CVE-2026-55893?

A patch was published on 2026-06-18: Fix committed to next branch (6.0.0-Alpha10); backport to v5.x in PR #2969 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55893 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-55893?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55893: Capstone heap buffer overflow in SH floating-point decoders

CVE-2026-55893 · Severity: info · Published 2026-08-20

Capstone is a widely-used disassembly and instruction analysis library used in reverse engineering, malware analysis, and security research tools. A heap buffer overflow vulnerability in the SH floating-point instruction decoders can allow attackers to crash applications or potentially execute arbitrary code by sending specially crafted SH architecture instructions to the disassembler.

Quick answers

Is CVE-2026-55893 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55893 being exploited in the wild.
How severe is CVE-2026-55893?: Informational severity, published 20 August 2026.
Which products and versions are affected?: Capstone Capstone 6.0.0-Alpha9 and earlier.
Is there a fix for CVE-2026-55893?: A patch was published on 2026-06-18: Fix committed to next branch (6.0.0-Alpha10); backport to v5.x in PR #2969 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55893 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-55893?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a heap buffer overflow in Capstone's arch/SH/SHDisassembler.c file. The SH floating-point decoders (opFADD, opFMUL, opFSUB) call set_reg() and set_reg_n() functions using sh_info.op.op_count without validating that the operand index stays within bounds of the fixed-size operands[] array (176 bytes). When processing crafted instructions via cs_disasm_iter() or cs_disasm() with specific architecture modes (CS_ARCH_SH with CS_MODE_SH2A/SH4A, plus CS_MODE_SHFPU and CS_OPT_DETAIL), the operand count can be incremented beyond array bounds, resulting in a four-byte out-of-bounds heap write. This requires network access or local processing of untrusted binary input; the fix adds bounds checking and was patched in version 6.0.0-Alpha10 and backported to version 5.x.

Affected products

Capstone Capstone 6.0.0-Alpha9 and earlier

Timeline

2026-08-20: disclosed
2026-06-18: patched: Fix committed to next branch (6.0.0-Alpha10); backport to v5.x in PR #2969

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.