The bounds-check failure in Capstone's SHDisassembler (CVE-2026-55894) rates Medium, but its practical impact is broader than the severity suggests. The flaw occurs because the disassembler computes an instruction index from raw bytecode and uses it to branch into a mode-specific decode[] function-pointer table without validating that the index falls within the table bounds. When an architecture supports multiple modes (SH2A, SH4A, optional FPU variants), the decode table must be partitioned or conditionally indexed based on active modes — and the validation logic lives in a separate code path from the index computation, creating a semantic gap where bounds checking can be forgotten without syntax errors or compiler warnings.
This matters because Capstone is a library embedded in reverse engineering frameworks, objdump derivatives, and security scanners. A segfault in any disassembler handler is a denial-of-service vector against anything parsing untrusted bytecode through Capstone, regardless of what architecture the input targets. Your tool doesn't need to disassemble SH code specifically to be vulnerable — it just needs to link against a Capstone version that handles SH inputs.
The deeper problem is that this isn't a one-off oversight — it's a structural pattern. The coupling between mode selection and index computation is logically inseparable, but C has no mechanism to express 'this index is only valid when this mode is active.' Developers reason about instruction encoding logic, not memory safety invariants, so bounds validation feels like boilerplate and gets deferred under time pressure. Unit testing catches crashes but misses the combinatorial blast radius of mode-conditional dispatch — the space of valid mode combinations is large enough that coverage gaps are guaranteed, not possible.
The Alpha-10 patch likely added a bounds check at the call site, which closes this instance but leaves the architectural problem intact. Check that your Capstone version includes the fix. If you're embedding Capstone in security-critical tooling, add your own defensive checks around mode selection and index computation — the next flaw in this class may not be in SH, and may not get caught before your downstream consumers are exposed.