CVE-2026-47143: Capstone Framework DOS Vulnerability

CVE-2026-47143 Overview

CVE-2026-47143 is a NULL pointer dereference vulnerability [CWE-476] in the Capstone disassembly framework. The flaw resides in modRMRequired() and decode() when parsing 3DNow! opcodes (0F 0F) in builds compiled with the -DCAPSTONE_X86_REDUCE flag. A remote attacker can crash any application linked against the reduced X86 Capstone library by supplying a crafted 4-byte input sequence 0F 0F <modrm> <imm8>. Versions prior to 6.0.0-Alpha8 and 5.0.8 are affected. The Capstone project addressed the issue in versions 6.0.0-Alpha8 and 5.0.8.

Critical Impact
Applications using the reduced X86 Capstone library can be crashed by a 4-byte crafted input, causing denial of service in binary analysis tools, sandboxes, and reverse engineering pipelines.

Affected Products

Capstone disassembly framework versions prior to 5.0.8 (5.x branch)
Capstone disassembly framework versions prior to 6.0.0-Alpha8 (6.x branch)
Applications compiled with -DCAPSTONE_X86_REDUCE linking against vulnerable Capstone builds

Discovery Timeline

2026-07-21 - CVE-2026-47143 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47143

Vulnerability Analysis

Capstone is a widely used multi-architecture disassembly framework embedded in reverse engineering tools, malware sandboxes, and security scanners. The vulnerability affects builds compiled with the -DCAPSTONE_X86_REDUCE option, which produces a slimmer X86 decoder that omits certain opcode tables. When the reduced decoder encounters the 3DNow! escape sequence 0F 0F, the decoding logic in modRMRequired() and decode() reaches a code path where the opcode decision table is not initialized. The functions then dereference a NULL pointer, terminating the host process.

Exploitation is trivial: an attacker only needs to supply the 4-byte sequence 0F 0F <modrm> <imm8> as input to any tool that feeds untrusted bytes to the reduced Capstone library. Because Capstone is embedded in automated analysis pipelines, a single crafted sample can halt scanning workflows.

Root Cause

The root cause is a missing default handler in the opcode switch statement inside arch/X86/X86DisassemblerDecoder.c. In the reduced build configuration, 3DNow! opcode entries are excluded from the decision table, but the decoder still follows the code path that expects a valid decision pointer. The default branch of the switch fell through without returning, leaving decision uninitialized and later dereferenced.

Attack Vector

The attack vector is local input processing: an attacker delivers a crafted binary blob to any application that uses the reduced X86 Capstone library for disassembly. This includes binary analysis platforms, YARA-integrated scanners, and automated malware triage systems. No authentication or user interaction is required at the library level.

// Security patch in arch/X86/X86DisassemblerDecoder.c
// The default switch branch now returns false instead of falling through,
// preventing use of an uninitialized decision table pointer.

	switch (type) {
	default:
-		break;
+		return false;
	case ONEBYTE:
		decision = ONEBYTE_SYM;
		indextable = index_x86DisassemblerOneByteOpcodes;
// Source: https://github.com/capstone-engine/capstone/commit/a0201371719b5aaa91d318ab2898843718f92d1f

The backport for the 5.x branch applies the same fix:

// Backport of CVE-2026-47143 fix (#2924)
	unsigned int index;

	switch (type) {
-		default: break;
+		default:
+			return false;
		case ONEBYTE:
			decision = ONEBYTE_SYM;
			indextable = index_x86DisassemblerOneByteOpcodes;
// Source: https://github.com/capstone-engine/capstone/commit/fab595205fee206f5c21be6ed8ad2eaf9225f1c7

Detection Methods for CVE-2026-47143

Indicators of Compromise

Repeated crashes or segmentation faults in processes that embed the Capstone library, especially those built with -DCAPSTONE_X86_REDUCE.
Input samples or network payloads containing the 4-byte sequence 0F 0F <modrm> <imm8> submitted to analysis tools.
Core dumps referencing modRMRequired() or decode() in X86DisassemblerDecoder.c.

Detection Strategies

Inventory all internal tools, sandboxes, and SDKs that statically or dynamically link Capstone, and identify those built with the reduced X86 configuration.
Enable core dump collection on analysis hosts to capture stack traces pointing at the vulnerable decoder functions.
Add file and stream inspection rules that flag disassembler inputs containing 0F 0F followed by two arbitrary bytes when 3DNow! decoding is not expected.

Monitoring Recommendations

Monitor exit codes and restart frequency of automated malware analysis workers linked against Capstone.
Track library versions across build pipelines and alert when versions below 5.0.8 or 6.0.0-Alpha8 are pulled from package repositories.
Correlate crash telemetry with recently ingested samples to identify malicious inputs targeting analysis infrastructure.

How to Mitigate CVE-2026-47143

Immediate Actions Required

Upgrade Capstone to version 5.0.8 for the 5.x branch or 6.0.0-Alpha8 for the 6.x branch.
Rebuild and redeploy all downstream tools that statically link Capstone after upgrading the source tree.
Audit build configurations for the -DCAPSTONE_X86_REDUCE flag and confirm patched sources are in use before recompiling.

Patch Information

The upstream fix adds an explicit return false in the default branch of the opcode type switch inside arch/X86/X86DisassemblerDecoder.c. See the GitHub Security Advisory GHSA-289w-cm54-fgrm, the main branch commit, the 5.x backport commit, and the associated pull request #2924.

Workarounds

Rebuild Capstone without the -DCAPSTONE_X86_REDUCE option to use the full X86 decoder, which is not affected by this code path.
Pre-filter untrusted disassembly inputs to reject or sandbox streams containing the 0F 0F 3DNow! escape when 3DNow! support is not required.
Isolate disassembly workers in restart-tolerant containers so a crash does not disrupt the broader analysis pipeline.

bash

# Verify installed Capstone version and rebuild without the reduced X86 flag
cstool -v

# When compiling from source, omit -DCAPSTONE_X86_REDUCE
cmake -DCAPSTONE_ARCHITECTURE_DEFAULT=ON \
      -DCAPSTONE_X86_SUPPORT=ON \
      -DCAPSTONE_X86_REDUCE=OFF \
      -S . -B build
cmake --build build --config Release