CVE-2026-55894
- Source
- https://cve.org/CVERecord?id=CVE-2026-55894
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55894.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-55894
- Aliases
-
- GHSA-gf2c-xwcp-hvf4
- Downstream
- Published
- 2026-08-20T21:31:37.680Z
- Modified
- 2026-08-22T09:15:54.824596Z
- Severity
-
- 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode
- Details
-
Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c shdisassemble() function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table. An application using CSARCHSH with CSMODESH2A or CSMODESH4A and CSMODESHFPU can pass crafted bytecode through csdisasmiter() or csdisasm(), causing the decode[idx] test to read outside the table and terminate the process with a segmentation fault. No code execution or information disclosure was demonstrated. This issue is fixed in version 6.0.0-Alpha10.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-125" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55894.json" }- References
-
- https://github.com/capstone-engine/capstone/releases/tag/6.0.0-Alpha10
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55894.json
- https://github.com/capstone-engine/capstone/security/advisories/GHSA-gf2c-xwcp-hvf4
- https://nvd.nist.gov/vuln/detail/CVE-2026-55894
- https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e
- https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed
- https://github.com/capstone-engine/capstone/pull/2968
- https://github.com/capstone-engine/capstone/pull/2969
Affected packages
Git / github.com/capstone-engine/capstone
Affected ranges
- Type
- GIT
- Repo
- https://github.com/capstone-engine/capstone
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "6.0.0-Alpha10" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
1.*
1.0
2.*
2.0
2.0-rc1
2.1
3.*
3.0-rc1
3.0-rc2
3.0-rc3
4.*
4.0-alpha1
4.0-alpha2
4.0-alpha3
4.0-alpha4
4.0-alpha5
5.*
5.0-rc1
5.0-rc2
5.0-rc3
5.0-rc4
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
6.*
6.0.0-Alpha3
6.0.0-Alpha4
6.0.0-Alpha5
6.0.0-Alpha6
6.0.0-Alpha7
6.0.0-Alpha8
6.0.0-Alpha9
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55894.json"
vanir_signatures
[
{
"target": {
"function": "opMOV_rind",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed",
"id": "CVE-2026-55894-1c5fd500",
"signature_version": "v1",
"digest": {
"length": 463.0,
"function_hash": "111621750072723809347341125391406727264"
},
"signature_type": "Function"
},
{
"target": {
"function": "set_mem_n",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed",
"id": "CVE-2026-55894-1cc37508",
"signature_version": "v1",
"digest": {
"length": 778.0,
"function_hash": "208058099951435225158930433934993572899"
},
"signature_type": "Function"
},
{
"target": {
"function": "set_reg",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
"id": "CVE-2026-55894-375792be",
"signature_version": "v1",
"digest": {
"length": 185.0,
"function_hash": "245580544992383184281023978705159020663"
},
"signature_type": "Function"
},
{
"target": {
"function": "op4xxb",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
"id": "CVE-2026-55894-4a9ef06a",
"signature_version": "v1",
"digest": {
"length": 1756.0,
"function_hash": "335444738187917447247733973622325853441"
},
"signature_type": "Function"
},
{
"target": {
"function": "opMOV_BW_dsp",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
"id": "CVE-2026-55894-53386370",
"signature_version": "v1",
"digest": {
"length": 507.0,
"function_hash": "282879095551101401766817839454973258158"
},
"signature_type": "Function"
},
{
"target": {
"function": "main",
"file": "tests/integration/test_poc.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
"id": "CVE-2026-55894-56317aa0",
"signature_version": "v1",
"digest": {
"length": 63.0,
"function_hash": "60581121344323394982684846690472597602"
},
"signature_type": "Function"
},
{
"target": {
"function": "set_mem",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed",
"id": "CVE-2026-55894-6600eb32",
"signature_version": "v1",
"digest": {
"length": 229.0,
"function_hash": "131655530364642469674223518597885502056"
},
"signature_type": "Function"
},
{
"target": {
"function": "set_reg_n",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed",
"id": "CVE-2026-55894-68b9d80a",
"signature_version": "v1",
"digest": {
"length": 243.0,
"function_hash": "203561472378139921459965054994187227438"
},
"signature_type": "Function"
},
{
"target": {
"function": "set_mem",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
"id": "CVE-2026-55894-788f89cc",
"signature_version": "v1",
"digest": {
"length": 229.0,
"function_hash": "131655530364642469674223518597885502056"
},
"signature_type": "Function"
},
{
"target": {
"file": "tests/integration/test_poc.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
"id": "CVE-2026-55894-82aed326",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"56681790147492349595328234047966935599",
"298084201049342381613159388341196995820",
"90277616625833746295729598954723929832",
"271591085299199007001640275329933269544",
"169103068490501063730588007688891148204",
"262916325913926881832611111089645264000"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "sh_disassemble",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed",
"id": "CVE-2026-55894-8622263a",
"signature_version": "v1",
"digest": {
"length": 1560.0,
"function_hash": "112994267864934544459834941867444849556"
},
"signature_type": "Function"
},
{
"target": {
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
"id": "CVE-2026-55894-8c67751a",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"97550690778504212196682144321503735696",
"130803129017180827214580273675484486004",
"138838081369681749869030457252729936051",
"247835972454535981406350425289403460081",
"293899838517004412071926869816659593741",
"157291195502530201525107257558167395977",
"120666967994025705272779178623516289776",
"100936572138949324841131051362514701",
"87514018156856684377609402163719430573",
"116275769031055623692104003502941459604",
"293617064405114722609218710965456939030",
"85286952801048811852504966338507645197",
"102558535547059923131188712413106791150",
"57666779477811814250444556534629781485",
"212512629981815889159596399116592728933",
"309456904552599226064907178835913711955",
"202307328750901692381345412133678381152",
"276662566221026512616827708221505570207",
"270374065965792188794215669391376627436",
"140010709814199722806207979940131620919",
"149954327677934168499907570337221087",
"88988598075187230386828591238582976424",
"95942363800685116240043899357971875441",
"278421004904408571607488246103357428521",
"177675013372981908946634110975095310900",
"260912625565500179117486721883005782140",
"275489396545161715156769898077644486306",
"198841576822439209287035877701875685189",
"25065623801440579918577069298432043209",
"295424583566066879467334962613146807183",
"211684568181461391035184951726402258516",
"46685258013375012841686643273935380717",
"181004434837034993790203037818549089032",
"28693936378871532409800986205863907144",
"224438518003410419113964230205993261874",
"213857051892733519691879825088840801606",
"322994768754203312901110661398313211882",
"162641685670950410053363749145851398682",
"7193587451508942624739951259097820837",
"69436993729531430886451513791936615301",
"79063577261539846510632771701254374024",
"163170202356517486343032669937656791732",
"228294428292904100685351278592241478441",
"68832951775927631619227834852006521634",
"168284854989703351947416934440260150146",
"300245923175808976896013293789265246876",
"114446661333012723385645210707170472139",
"120461527008804588554636494256739200897",
"161078168383579574881383145830226805023",
"302509794609374560073301687998066833797",
"35974507107628124256811272493868373219",
"10803255704879185201872619090450796887",
"300245923175808976896013293789265246876",
"114446661333012723385645210707170472139",
"5542981775006699264271729725470130212",
"40379959555609388686238447808429140233",
"289893107230583288326992723067585814618",
"227204709489460750060670334555357751948",
"198712940500799729655972705359308668225",
"72290405273968857376847039313514476363",
"268153692801004659795029733389079441225",
"110684617342857992027859222441648392162",
"311911910497378128982953012907101926999",
"208776306728530628151156056110713250043",
"59283537226134191769393164335350362906",
"84269844450425987657582965054109002922",
"77983467619195106735243028575373708321",
"242676822444625188663446902797617827985",
"138114114663194251783993066781969375887",
"220802706246091501928246843493349349254",
"163015328066292325067972078330532722022",
"311165807396934671974788471133328016520",
"70741974830826213721940033261674796246",
"260062557830108351357564797505357466748",
"242676822444625188663446902797617827985",
"51783150396799362992814862280240394686",
"54564026883098046631408215461741659647",
"144022630374248897287269002647143520922",
"187460134033463982672553296836738719974",
"291456661093819079037700118809882855656",
"161334864720222522098391320080146080796",
"184282637838069876326357617211038566922",
"43657582335184883980040793487434836347",
"107431030738899280732939649049253815823",
"181009696756719497807123875121915285842",
"327656452989591119577254751229786433605"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "set_reg_n",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
"id": "CVE-2026-55894-af6eb4be",
"signature_version": "v1",
"digest": {
"length": 243.0,
"function_hash": "203561472378139921459965054994187227438"
},
"signature_type": "Function"
},
{
"target": {
"function": "op4xxb",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed",
"id": "CVE-2026-55894-b6b5bfb8",
"signature_version": "v1",
"digest": {
"length": 1741.0,
"function_hash": "100217292965289654423600218360889076667"
},
"signature_type": "Function"
},
{
"target": {
"function": "set_mem_n",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
"id": "CVE-2026-55894-b7a9220d",
"signature_version": "v1",
"digest": {
"length": 778.0,
"function_hash": "208058099951435225158930433934993572899"
},
"signature_type": "Function"
},
{
"target": {
"function": "sh_disassemble",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
"id": "CVE-2026-55894-ba033395",
"signature_version": "v1",
"digest": {
"length": 1589.0,
"function_hash": "164800201630503314454414320027777151069"
},
"signature_type": "Function"
},
{
"target": {
"function": "opMOVx",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
"id": "CVE-2026-55894-bc2b134b",
"signature_version": "v1",
"digest": {
"length": 824.0,
"function_hash": "21950857795304117040334495707286305560"
},
"signature_type": "Function"
},
{
"target": {
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed",
"id": "CVE-2026-55894-bcd13ab0",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"239805492558515764723725372283471515101",
"130803129017180827214580273675484486004",
"138838081369681749869030457252729936051",
"247835972454535981406350425289403460081",
"278265399590353839814762220341864853410",
"157291195502530201525107257558167395977",
"120666967994025705272779178623516289776",
"100936572138949324841131051362514701",
"87514018156856684377609402163719430573",
"116275769031055623692104003502941459604",
"293617064405114722609218710965456939030",
"85286952801048811852504966338507645197",
"102558535547059923131188712413106791150",
"144997807292818477385256546450441320520",
"253412802228259458304891017871474947092",
"138136232967112531358900283363602259825",
"142284960593371967867469005469598099614",
"226469243488259421738616311538183527958",
"189471832993193025457374421876645620345",
"270374065965792188794215669391376627436",
"140010709814199722806207979940131620919",
"149954327677934168499907570337221087",
"196921488189038071948860272047761759327",
"95942363800685116240043899357971875441",
"278421004904408571607488246103357428521",
"177675013372981908946634110975095310900",
"241048025276014268650759488214593359299",
"275489396545161715156769898077644486306",
"198841576822439209287035877701875685189",
"25065623801440579918577069298432043209",
"101700168589681985363480273136819034583",
"211684568181461391035184951726402258516",
"46685258013375012841686643273935380717",
"181004434837034993790203037818549089032",
"175676119402902806729468101776446300279",
"224438518003410419113964230205993261874",
"213857051892733519691879825088840801606",
"195064637925743973914298309338864859085",
"162641685670950410053363749145851398682",
"7193587451508942624739951259097820837",
"69436993729531430886451513791936615301",
"229343484353203078727404711647174919314",
"55820854580302120414109801543558268626",
"228294428292904100685351278592241478441",
"68832951775927631619227834852006521634",
"168284854989703351947416934440260150146",
"266549093774239509899111381167269693930",
"114446661333012723385645210707170472139",
"120461527008804588554636494256739200897",
"290523632450858786077939545885108160840",
"302509794609374560073301687998066833797",
"35974507107628124256811272493868373219",
"10803255704879185201872619090450796887",
"50222300351181377616125323515088015681",
"114446661333012723385645210707170472139",
"5542981775006699264271729725470130212",
"40379959555609388686238447808429140233",
"289893107230583288326992723067585814618",
"59010863419397613171305540848956772915",
"198712940500799729655972705359308668225",
"72290405273968857376847039313514476363",
"268153692801004659795029733389079441225",
"114022158715413068840118613502381985976",
"197629636430649751690705949930201145757",
"208776306728530628151156056110713250043",
"59283537226134191769393164335350362906",
"84269844450425987657582965054109002922",
"90002922949594180242868930673450276687",
"242676822444625188663446902797617827985",
"138114114663194251783993066781969375887",
"199353566821766145495729133203332817080",
"163015328066292325067972078330532722022",
"311165807396934671974788471133328016520",
"70741974830826213721940033261674796246",
"77983467619195106735243028575373708321",
"242676822444625188663446902797617827985",
"51783150396799362992814862280240394686",
"54564026883098046631408215461741659647",
"144022630374248897287269002647143520922",
"187460134033463982672553296836738719974",
"291456661093819079037700118809882855656",
"161334864720222522098391320080146080796",
"184282637838069876326357617211038566922",
"43657582335184883980040793487434836347",
"293231198073022181645541690059805104222",
"249685555468530349182068263002986660080",
"59093474781337102843412182585074054112"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "opMOV_L_dsp",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
"id": "CVE-2026-55894-bd172cfa",
"signature_version": "v1",
"digest": {
"length": 452.0,
"function_hash": "154671398753303063859898133976958703100"
},
"signature_type": "Function"
},
{
"target": {
"function": "opMOVx",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed",
"id": "CVE-2026-55894-d4b30d02",
"signature_version": "v1",
"digest": {
"length": 824.0,
"function_hash": "21950857795304117040334495707286305560"
},
"signature_type": "Function"
},
{
"target": {
"function": "opMOV_L_dsp",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed",
"id": "CVE-2026-55894-e3be83c5",
"signature_version": "v1",
"digest": {
"length": 452.0,
"function_hash": "154671398753303063859898133976958703100"
},
"signature_type": "Function"
},
{
"target": {
"function": "opMOV_rind",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/09e76802380b9e94d9720c44458d9d5282219e7e",
"id": "CVE-2026-55894-e452f5c4",
"signature_version": "v1",
"digest": {
"length": 463.0,
"function_hash": "111621750072723809347341125391406727264"
},
"signature_type": "Function"
},
{
"target": {
"function": "set_reg",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed",
"id": "CVE-2026-55894-e785f853",
"signature_version": "v1",
"digest": {
"length": 185.0,
"function_hash": "245580544992383184281023978705159020663"
},
"signature_type": "Function"
},
{
"target": {
"function": "opMOV_BW_dsp",
"file": "arch/SH/SHDisassembler.c"
},
"deprecated": false,
"source": "https://github.com/capstone-engine/capstone/commit/e17ee44a8307ea33375b4727ac4f987650bf7bed",
"id": "CVE-2026-55894-f7bbe132",
"signature_version": "v1",
"digest": {
"length": 507.0,
"function_hash": "282879095551101401766817839454973258158"
},
"signature_type": "Function"
}
]
vanir_signatures_modified
"2026-08-22T09:15:54Z"