CVE-2026-47143

ADVISORY - debian

Summary

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in modRMRequired() and decode() when disassembling 3DNow! opcodes (0F 0F) in builds compiled with -DCAPSTONE_X86_REDUCE, allowing a remote attacker to crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence 0F 0F <modrm> <imm8>. Versions 6.0.0-Alpha8 and 5.0.8 patch the issue.

capstone https://github.com/capstone-engine/capstone/security/advisories/GHSA-289w-cm54-fgrm https://github.com/capstone-engine/capstone/pull/2924 Fixed by: https://github.com/capstone-engine/capstone/commit/fab595205fee206f5c21be6ed8ad2eaf9225f1c7 (5.0.8)

EPSS Score⁠: 0.00177 (0.075)

Common Weakness Enumeration (CWE)

Impacted images

Advisories

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.