# CVE-2026-55893: Capstone heap buffer overflow in SH floating-point decoders

Source: https://junglewise.ai/threats/cve-2026-55893-capstone-heap-buffer-overflow-in-sh-floating-point-decoders  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55893 · Severity: info · Published 2026-08-20

Capstone is a widely-used disassembly and instruction analysis library used in reverse engineering, malware analysis, and security research tools. A heap buffer overflow vulnerability in the SH floating-point instruction decoders can allow attackers to crash applications or potentially execute arbitrary code by sending specially crafted SH architecture instructions to the disassembler.

## Quick answers

**Is CVE-2026-55893 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55893 being exploited in the wild.

**How severe is CVE-2026-55893?** Informational severity, published 20 August 2026.

**Which products and versions are affected?** Capstone Capstone 6.0.0-Alpha9 and earlier.

**Is there a fix for CVE-2026-55893?** A patch was published on 2026-06-18: Fix committed to next branch (6.0.0-Alpha10); backport to v5.x in PR #2969 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55893 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-55893?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a heap buffer overflow in Capstone's arch/SH/SHDisassembler.c file. The SH floating-point decoders (opFADD, opFMUL, opFSUB) call set_reg() and set_reg_n() functions using sh_info.op.op_count without validating that the operand index stays within bounds of the fixed-size operands[] array (176 bytes). When processing crafted instructions via cs_disasm_iter() or cs_disasm() with specific architecture modes (CS_ARCH_SH with CS_MODE_SH2A/SH4A, plus CS_MODE_SHFPU and CS_OPT_DETAIL), the operand count can be incremented beyond array bounds, resulting in a four-byte out-of-bounds heap write. This requires network access or local processing of untrusted binary input; the fix adds bounds checking and was patched in version 6.0.0-Alpha10 and backported to version 5.x.

## Affected products

- Capstone Capstone 6.0.0-Alpha9 and earlier

## Timeline

- 2026-08-20: disclosed
- 2026-06-18: patched: Fix committed to next branch (6.0.0-Alpha10); backport to v5.x in PR #2969

## References

- [https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e](https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e)
- [https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed](https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed)