Capstone’s SH floating‑point decoders invoke set_reg() and set_reg_n() based on an operation count without bounding against the fixed‑size operand array. When a crafted series of SH2A/FPU instructions is parsed with cs_disasm_iter() or cs_disasm(), the operand count can exceed the allocated 176‑byte buffer, causing a four‑byte heap write past the end of the allocation. This corruption can crash the process or, depending on heap layout, may allow an attacker to inject and execute arbitrary code.

The vulnerability exists in the Capstone disassembly framework provided by Capstone Engine, specifically in version 6.0.0‑Alpha9 and earlier. Any deployment of Capstone that decodes SH architecture instructions with SHFPU support (CS_MODE_SH2A or CS_MODE_SH4A) and enables detailed output (CS_OPT_DETAIL) is affected.

The CVSS score of 7.3 indicates high severity, while the EPSS score of < 1% suggests a low but non‑zero exploitation probability; the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to supply crafted SH instructions to the disassembler, which typically limits the attack to environments where Capstone processes untrusted machine code. However, if local code execution is possible, the risk is significant due to the potential for arbitrary code execution through the heap overflow.