Executive brief
Capstone is a widely-used disassembly and instruction analysis library used in reverse engineering, malware analysis, and security research tools. A heap buffer overflow vulnerability in the SH floating-point instruction decoders can allow attackers to crash applications or potentially execute arbitrary code by sending specially crafted SH architecture instructions to the disassembler.
Technical details
The vulnerability is a heap buffer overflow in Capstone's arch/SH/SHDisassembler.c file. The SH floating-point decoders (opFADD, opFMUL, opFSUB) call set_reg() and set_reg_n() functions using sh_info.op.op_count without validating that the operand index stays within bounds of the fixed-size operands[] array (176 bytes). When processing crafted instructions via cs_disasm_iter() or cs_disasm() with specific architecture modes (CS_ARCH_SH with CS_MODE_SH2A/SH4A, plus CS_MODE_SHFPU and CS_OPT_DETAIL), the operand count can be incremented beyond array bounds, resulting in a four-byte out-of-bounds heap write. This requires network access or local processing of untrusted binary input; the fix adds bounds checking and was patched in version 6.0.0-Alpha10 and backported to version 5.x.
Affected products
- Capstone Capstone 6.0.0-Alpha9 and earlier
Timeline
- 2026-08-20: disclosed
- 2026-06-18: patched: Fix committed to next branch (6.0.0-Alpha10); backport to v5.x in PR #2969