---
id: CVE-2026-47143
aliases:
  - PYSEC-2026-3544
  - GHSA-289w-cm54-fgrm
title: >-
  Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8
  have a NULL pointer dereference in `modRMRequired()` and `d…
summary: >-
  Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8
  have a NULL pointer dereference in `modRMRequired()` and `decode()` when
  disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with
  `-DCAPSTONE_X86_REDUCE`…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: capstone
product: capstone
ecosystem: pip
affected:
  - capstone < 5.0.8
patched:
  - capstone 5.0.8
published: '2026-07-21'
updated: '2026-07-31'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/PYSEC-2026-3544'
references:
  - url: >-
      https://github.com/capstone-engine/capstone/commit/a0201371719b5aaa91d318ab2898843718f92d1f
  - url: >-
      https://github.com/capstone-engine/capstone/commit/fab595205fee206f5c21be6ed8ad2eaf9225f1c7
  - url: 'https://github.com/capstone-engine/capstone/pull/2924'
  - url: >-
      https://github.com/capstone-engine/capstone/security/advisories/GHSA-289w-cm54-fgrm
tags:
  - osv
  - pip
epss: 0.00468
epssPercentile: 0.37874
ingestedAt: '2026-07-31T19:10:07.604Z'
---

## Overview

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with `-DCAPSTONE_X86_REDUCE`, allowing a remote attacker to crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence `0F 0F <modrm> <imm8>`. Versions 6.0.0-Alpha8 and 5.0.8 patch the issue.

## Affected packages

- `capstone < 5.0.8`

## Remediation

Upgrade to a patched release:

- `capstone 5.0.8`