CVE-2026-55893

The vulnerability in Capstone's SH FPU disassembler (CVE-2026-55893) is fundamentally an API contract violation rather than a parsing logic flaw. The floating-point handlers—opFADD, opFMUL, opFSCR, and similar functions—increment an operand counter (sh_info.op.op_count) and then write to register storage via set_reg() and set_reg_n() without validating against the fixed allocation boundary. This is a bounds-checking omission on write operations, not a subtle edge case in instruction encoding interpretation. The structural weak point is the set_reg() and set_reg_n() API itself: these functions accept an externally-controlled counter and perform writes with no internal guardrails. Multiple handlers independently arrived at the same violation pattern—that's not coincidence, it's a codebase teaching contributors that this usage is acceptable. The fix in 6.0.0-Alpha10 likely added localized guards to these specific handlers, but the deeper question is whether Capstone has audited the broader operand handling logic across other SH instructions and architectures for the same trust violation pattern. The trigger conditions—CS_ARCH_SH with SH2A or SH4A mode, SHFPU mode, and CS_OPT_DETAIL enabled—narrow which applications are potentially exposed, but CS_OPT_DETAIL is a standard configuration option used by reverse engineering tooling, security scanners, malware analysis pipelines, and debugger backends. Any disassembler processing untrusted SH FPU binaries with detail output enabled is vulnerable. The heap-layout dependency for code execution means exploitation is environment-sensitive rather than reliably triggerable, but this increases rather than decreases remediation urgency—environment-sensitive overflows persist longer because they fail to reproduce in standard test harnesses and get triaged as low-risk. The Alpha version qualifier deserves attention. Organizations running Alpha builds in production often do so because dependency chains, build reproducibility requirements, or legacy integration constraints make version upgrades genuinely costly—not out of negligence. The patch in Alpha10 may not trigger the same patching discipline as a stable release, leaving deployed tooling vulnerable while the upstream code is technically fixed. The real question isn't whether these three handlers are patched, but whether Capstone has an automated mechanism to prevent this pattern from recurring across remaining handlers and other architectures.

Reviewed through automated stages and approved by a human before publication.