CVE-2026-55893
Description
A flaw was found in Capstone, a disassembly framework. The SH floating-point decoders in arch/SH/SHDisassembler.c do not correctly validate the size of the operands[] array when processing certain instructions. This vulnerability allows a local attacker to provide specially crafted SH2A FPU bytecode, leading to a heap buffer overflow. Successful exploitation can cause the application to crash, resulting in a Denial of Service (DoS), and may potentially enable arbitrary code execution.
Statement
A MODERATE impact heap buffer overflow was found in Capstone, a disassembly framework shipped in Red Hat Enterprise Linux 9 and 10, Red Hat OpenShift Container Platform (via RHEL CoreOS 9), Red Hat In-Vehicle OS, and Red Hat Hardened Images, as well as in Fedora and EPEL community packages, including applications that bundle Capstone such as imhex and pe-bear. The SH floating-point instruction decoders in Capstone's arch/SH/SHDisassembler.c (for example opFADD, opFMUL, and opFSUB) call set_reg() and set_reg_n() using sh_info.op.op_count without validating it against the fixed-size operands[] array. When an application disassembles specially crafted SH2A or SH4A FPU instructions through cs_disasm() or cs_disasm_iter() with CS_ARCH_SH, CS_MODE_SHFPU, and CS_OPT_DETAIL enabled, the operand count can grow beyond the 176-byte sh_info allocation and perform a four-byte heap buffer overflow write. A local attacker able to supply such crafted bytecode to an application that disassembles it could crash the application, causing a denial of service, and may potentially achieve code execution depending on heap layout. Although the upstream CVSS scores (CVEORG CVSS:4.0 7.3 and Red Hat CVSS:3.1 7.0) fall in the Important severity range, Red Hat rates this flaw as MODERATE impact because exploitation requires local access to crafted input, high attack complexity, and user interaction for the malicious instructions to be processed. All affected Red Hat product streams are marked AFFECTED with a fix being pursued through the responsible product teams.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Read Memory; Modify Memory; Execute Unauthorized Code or Commands
When the length value exceeds the size of the destination, an out-of-bounds read or write could occur. Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. This can often be used to subvert any other security service.
Availability
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
