An out‑of‑bounds read in Capstone’s SH disassembler allows an attacker to supply crafted SH2A or SH4A bytecode that causes the library to dereference a pointer outside the decode table. The result is a segmentation fault that crashes the process. No code execution or information disclosure has been demonstrated, and the flaw is classified as a memory safety violation.

The vulnerability affects the Capstone disassembly framework from the capstone-engine project. Versions 6.0.0‑Alpha9 and earlier are impacted when the library is used with the CS_ARCH_SH architecture in CS_MODE_SH2A or CS_MODE_SH4A combined with CS_MODE_SHFPU.

With a CVSS score of 6.8 the flaw is considered moderate. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, indicating limited publicly known exploit activity. The vulnerability can be triggered by an attacker who can influence the bytecode fed to cs_disasm_iter() or cs_disasm(), allowing a denial of service via process crash. No known remote code execution or data exfiltration paths exist for this flaw.