CVE-2026-47143 Details
Description
Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with `-DCAPSTONE_X86_REDUCE`, allowing a remote attacker to crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence `0F 0F <modrm> <imm8>`. Versions 6.0.0-Alpha8 and 5.0.8 patch the issue.
A NULL pointer dereference vulnerability has been identified in the Capstone disassembly framework, specifically in versions prior to 6.0.0-Alpha8 and 5.0.8. The issue arises in the X86 disassembler when handling 3DNow! opcodes ('0F 0F') in builds in which 'CAPSTONE_X86_REDUCE' is enabled. This vulnerability allows a remote attacker to cause a crash in any application that uses the reduced X86 Capstone library by sending a crafted input that includes the 4-byte sequence '0F 0F' followed by a ModRM byte and an immediate byte. The vulnerability exploits a flaw in the 'modRMRequired()' and 'decode()' functions, where the 'THREEDNOW_MAP' opcode type is not properly managed in reduced builds, leading to a dereference of a NULL pointer and a segmentation fault.
Users can upgrade to Capstone versions 6.0.0-Alpha8 or 5.0.9, both of which include the necessary fix for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| capstone-engine capstone | < 5.0.8 6.0.0 alpha1 6.0.0 alpha2 6.0.0 alpha3 6.0.0 alpha4 6.0.0 alpha5 6.0.0 alpha6 6.0.0 alpha7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |