Hi,

The following vulnerabilities were published for capstone.

CVE-2026-55893[0]:
| Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier,
| Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such
| as opFADD, opFMUL, and opFSUB call set_reg() and set_reg_n() using
| sh_info.op.op_count without checking the fixed-size operands[]
| array. Repeated crafted instructions processed through
| cs_disasm_iter() or cs_disasm() with CS_ARCH_SH, CS_MODE_SH2A or
| CS_MODE_SH4A, CS_MODE_SHFPU, and CS_OPT_DETAIL can increment the
| operand count beyond the 176-byte sh_info allocation and perform a
| four-byte heap buffer overflow write. The corruption can crash the
| process and may enable code execution depending on heap layout. This
| issue is fixed in version 6.0.0-Alpha10.


CVE-2026-55894[1]:
| Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier,
| Capstone's arch/SH/SHDisassembler.c sh_disassemble() function
| computes an idx value from a raw 16-bit instruction without ensuring
| it is within the active mode-specific decode[] function-pointer
| table. An application using CS_ARCH_SH with CS_MODE_SH2A or
| CS_MODE_SH4A and CS_MODE_SHFPU can pass crafted bytecode through
| cs_disasm_iter() or cs_disasm(), causing the decode[idx] test to
| read outside the table and terminate the process with a segmentation
| fault. No code execution or information disclosure was demonstrated.
| This issue is fixed in version 6.0.0-Alpha10.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-55893
https://www.cve.org/CVERecord?id=CVE-2026-55893
[1] https://security-tracker.debian.org/tracker/CVE-2026-55894
https://www.cve.org/CVERecord?id=CVE-2026-55894

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore