Source: capstone Version: 5.0.9-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for capstone. CVE-2026-55893[0]: | Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, | Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such | as opFADD, opFMUL, and opFSUB call set_reg() and set_reg_n() using | sh_info.op.op_count without checking the fixed-size operands[] | array. Repeated crafted instructions processed through | cs_disasm_iter() or cs_disasm() with CS_ARCH_SH, CS_MODE_SH2A or | CS_MODE_SH4A, CS_MODE_SHFPU, and CS_OPT_DETAIL can increment the | operand count beyond the 176-byte sh_info allocation and perform a | four-byte heap buffer overflow write. The corruption can crash the | process and may enable code execution depending on heap layout. This | issue is fixed in version 6.0.0-Alpha10. CVE-2026-55894[1]: | Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, | Capstone's arch/SH/SHDisassembler.c sh_disassemble() function | computes an idx value from a raw 16-bit instruction without ensuring | it is within the active mode-specific decode[] function-pointer | table. An application using CS_ARCH_SH with CS_MODE_SH2A or | CS_MODE_SH4A and CS_MODE_SHFPU can pass crafted bytecode through | cs_disasm_iter() or cs_disasm(), causing the decode[idx] test to | read outside the table and terminate the process with a segmentation | fault. No code execution or information disclosure was demonstrated. | This issue is fixed in version 6.0.0-Alpha10. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-55893 https://www.cve.org/CVERecord?id=CVE-2026-55893 [1] https://security-tracker.debian.org/tracker/CVE-2026-55894 https://www.cve.org/CVERecord?id=CVE-2026-55894 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
