Medium [CVE-2026-55894] Denial of Service via crafted SH2A bytecode
This medium-severity Red Hat Linux advisory covers CVE-2026-55894 affecting Red Hat Hardened Images, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table.
An application using CS_ARCH_SH with CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU can pass crafted bytecode through cs_disasm_iter() or cs_disasm(), causing the decode[idx] test to read outside the table and terminate the process with a segmentation fault. No code execution or information disclosure was demonstrated.
This issue is fixed in version 6.0.0-Alpha10. The `sh_disassemble()` function incorrectly processes 16-bit instructions, leading to an attempt to read data from an unauthorized memory location (an out-of-bounds read).
A remote attacker could exploit this by providing specially crafted bytecode to an application using Capstone in specific modes (SH2A or SH4A with SHFPU). This could cause the application to crash, resulting in a Denial of Service (DoS), where the service becomes unavailable.
This Moderate impact flaw in Capstone's SH disassembler can lead to a denial of service. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
Weakness: CWE-125.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
- 6.0.0
- 6.0.0-Alpha10
- capstone-main-5.0.8-0.3.hum1
- RHSA-2026:59419
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
Mitigation
Upgrade to a fixed release: 6.0.0, 6.0.0-Alpha10, capstone-main-5.0.8-0.3.hum1, RHSA-2026:59419. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.