CVE-2026-49282

Published: Ago 14, 2026 Last Modified: Ago 14, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,1
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: low

Description

AI Translation Available

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have missing or incomplete bounds checks. On a Capstone handle opened for M68K or RISCV, a caller-controlled invalid instruction ID can trigger an out-of-bounds read and crash the process. The demonstrated impact is availability loss in applications or bindings that expose instruction-name lookup to untrusted IDs. No code execution or data disclosure was demonstrated. Version 6.0.0-Alpha9 patches the issue.

125

Out-of-bounds Read

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Availability Other
Potential Impacts:
Read Memory Bypass Protection Mechanism Dos: Crash, Exit, Or Restart Varies By Context
Applicable Platforms
Languages: Memory-Unsafe, C, C++
Technologies: ICS/OT
View CWE Details
129

Improper Validation of Array Index

Draft
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Availability Confidentiality
Potential Impacts:
Dos: Crash, Exit, Or Restart Modify Memory Read Memory Execute Unauthorized Code Or Commands
Applicable Platforms
Languages: C, C++, Not Language-Specific
Likelihood of Exploit: High
View CWE Details
191

Integer Underflow (Wrap or Wraparound)

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Integrity Confidentiality Access Control
Potential Impacts:
Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Dos: Instability Modify Memory Execute Unauthorized Code Or Commands Bypass Protection Mechanism
Applicable Platforms
Languages: C, C++, Java, C#
View CWE Details
https://github.com/capstone-engine/capstone/blob/251c5bb4bc…
https://github.com/capstone-engine/capstone/blob/251c5bb4bc9bb92973e738ae3c5f4e…
https://github.com/capstone-engine/capstone/security/adviso…
https://github.com/capstone-engine/capstone/security/advisories/GHSA-jrw4-wj52-…