CVE-2026-55893

A flaw was found in Capstone, a disassembly framework. The SH floating-point decoders in arch/SH/SHDisassembler.c do not correctly validate the size of the operands[] array when processing certain instructions. This vulnerability allows a local attacker to provide specially crafted SH2A FPU bytecode, leading to a heap buffer overflow. Successful exploitation can cause the application to crash, resulting in a Denial of Service (DoS), and may potentially enable arbitrary code execution.

A MODERATE impact heap buffer overflow was found in Capstone, a disassembly framework shipped in Red Hat Enterprise Linux 9 and 10, Red Hat OpenShift Container Platform (via RHEL CoreOS 9), Red Hat In-Vehicle OS, and Red Hat Hardened Images, as well as in Fedora and EPEL community packages, including applications that bundle Capstone such as imhex and pe-bear. The SH floating-point instruction decoders in Capstone's arch/SH/SHDisassembler.c (for example opFADD, opFMUL, and opFSUB) call set_reg() and set_reg_n() using sh_info.op.op_count without validating it against the fixed-size operands[] array. When an application disassembles specially crafted SH2A or SH4A FPU instructions through cs_disasm() or cs_disasm_iter() with CS_ARCH_SH, CS_MODE_SHFPU, and CS_OPT_DETAIL enabled, the operand count can grow beyond the 176-byte sh_info allocation and perform a four-byte heap buffer overflow write. A local attacker able to supply such crafted bytecode to an application that disassembles it could crash the application, causing a denial of service, and may potentially achieve code execution depending on heap layout. Although the upstream CVSS scores (CVEORG CVSS:4.0 7.3 and Red Hat CVSS:3.1 7.0) fall in the Important severity range, Red Hat rates this flaw as MODERATE impact because exploitation requires local access to crafted input, high attack complexity, and user interaction for the malicious instructions to be processed. All affected Red Hat product streams are marked AFFECTED with a fix being pursued through the responsible product teams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.