CVE-2026-55894

Name of the Vulnerable Software and Affected Versions Capstone versions prior to 6.0.0-Alpha10

Description The sh disassemble() function in the arch/SH/SHDisassembler.c file computes an idx value from a raw 16-bit instruction without verifying if it remains within the active mode-specific decode[] function-pointer table. When an application uses CS ARCH SH with CS MODE SH2A or CS MODE SH4A and CS MODE SHFPU, providing crafted bytecode through cs disasm iter() or cs disasm() can cause the decode[idx] test to read outside the table, resulting in a segmentation fault that terminates the process.

Recommendations Update to version 6.0.0-Alpha10.