What’s Vulnerable › Vulnerabilities

CVE-2026-47143: Capstone has a NULL Pointer Dereference with 3DNow! opcodes

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-21 · updated 2026-10-24
• Weakness: CWE-476

Description

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with `-DCAPSTONE_X86_REDUCE`, allowing a remote attacker to crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence `0F 0F <modrm> <imm8>`. Versions 6.0.0-Alpha8 and 5.0.8 patch the issue.

Affected products

• capstone-engine capstone: before 5.0.8; 6.0.0-alpha1, 6.0.0-alpha2, 6.0.0-alpha3, 6.0.0-alpha4, 6.0.0-alpha5, 6.0.0-alpha6 (+1) — fixed in 5.0.8

How to fix

Upgrade to a fixed version: capstone-engine capstone 5.0.8. Check the vendor advisory for mitigations.

References

• https://github.com/capstone-engine/capstone/commit/a0201371719b5aaa91d318ab2898843718f92d1f
• https://github.com/capstone-engine/capstone/commit/fab595205fee206f5c21be6ed8ad2eaf9225f1c7
• https://github.com/capstone-engine/capstone/pull/2924
• https://github.com/capstone-engine/capstone/security/advisories/GHSA-289w-cm54-fgrm
• https://github.com/capstone-engine/capstone/security/advisories/GHSA-289w-cm54-fgrm

Get alerted when CVE-2026-47143 or the next vulnerability affects your stack