Capstone is a disassembly framework. Versions before 6.0.0-Alpha8 and 5.0.8 contain a NULL pointer dereference in the modRMRequired() and decode() routines when the library is built with -DCAPSTONE_X86_REDUCE and is asked to disassemble 3DNow! opcodes (0F 0F). By providing a 4‑byte sequence 0F 0F <modrm> <imm8> the attacker can trigger the null dereference and crash any application that uses the reduced‑mode Capstone library. The issue is a straightforward instance of CWE‑476 and leads only to a denial‑of‑service, not code execution. The patch in 6.0.0‑Alpha8 and 5.0.8 removes the vulnerability.

The affected vendor is Capstone Engine with the product Capstone, a disassembly framework. All releases earlier than version 6.0.0-Alpha8 and 5.0.8 are vulnerable when built with the reduced X86 mode enabled. Versions 6.0.0-Alpha8, 5.0.8 and later contain the fix.

The CVSS score of 5.1 indicates moderate severity, but the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, further suggesting it is not currently widely exploited. Based on the description, it is inferred that any application that relies on a reduced X86 Capstone build and is exposed to untrusted input could be brought down by a crafted packet, providing a likely remote denial‑of‑service vector. The likely attack requires the ability to supply binary data to the disassembly function, which is commonly available to tools used in reverse engineering and malware analysis.