CVE-2026-49282 in Capstone
Summary
by MITRE • 08/14/2026
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have missing or incomplete bounds checks. On a Capstone handle opened for M68K or RISCV, a caller-controlled invalid instruction ID can trigger an out-of-bounds read and crash the process. The demonstrated impact is availability loss in applications or bindings that expose instruction-name lookup to untrusted IDs. No code execution or data disclosure was demonstrated. Version 6.0.0-Alpha9 patches the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The Capstone disassembly framework represents a critical component in binary analysis and reverse engineering toolchains, providing developers with a unified interface for disassembling machine code across multiple architectures including M68K and RISCV. This vulnerability affects versions prior to 6.0.0-Alpha9 where the public `cs_insn_name()` API function exhibits a fundamental flaw in its handling of instruction identifiers. The issue stems from how the API processes caller-supplied instruction IDs, particularly when these identifiers are forwarded directly to architecture-specific backends without proper validation.
The technical implementation reveals that while most Capstone backends implement robust bounds checking mechanisms before accessing instruction-name tables, the M68K and RISCV backends demonstrate incomplete or missing validation procedures. This discrepancy creates a scenario where invalid instruction IDs can traverse the API call stack unimpeded, ultimately reaching backend components that assume valid input parameters. When these backends attempt to index into instruction-name lookup tables using malformed identifiers, they execute out-of-bounds memory reads that result in process crashes and complete system availability loss.
From an operational perspective, this vulnerability represents a significant concern for applications and software bindings that expose instruction-name lookup functionality to untrusted inputs or user-provided data. The impact extends beyond simple denial of service scenarios as it affects the reliability and stability of systems relying on Capstone for binary analysis tasks. Security practitioners should note that while no code execution or data disclosure was demonstrated in the vulnerability assessment, the availability impact remains severe enough to compromise system integrity in production environments where such frameworks are deployed.
The vulnerability aligns with CWE-129, which addresses insufficient input validation leading to out-of-bounds reads, and demonstrates characteristics consistent with ATT&CK technique T1059.007 for Windows Scripting while maintaining relevance across multiple operating systems where Capstone is deployed. Organizations utilizing Capstone in their security toolchains should prioritize updating to version 6.0.0-Alpha9 or later, as this release implements the necessary bounds checking mechanisms to prevent invalid instruction IDs from causing memory access violations. The patch addresses the root cause by ensuring all backend components properly validate input parameters before attempting table lookups, thereby maintaining system stability and preventing potential exploitation scenarios that could arise in more complex attack vectors.