This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-47143 →

DEBIAN-CVE-2026-47143

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when...

Original description

The description as published by the source.

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in modRMRequired() and decode() when disassembling 3DNow! opcodes (0F 0F) in builds compiled with -DCAPSTONE_X86_REDUCE, allowing a remote attacker to crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence 0F 0F . Versions 6.0.0-Alpha8 and 5.0.8 patch the issue.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 capstone

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 capstone

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 capstone

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.9-1"}]}]

References

advisory security-tracker.debian.org