capstone-engine Capstone up to 6.0.0-Alpha8 M68K/RISCV Backends cs_insn_name out-of-bounds

Summaryinfo

A vulnerability labeled as problematic has been found in capstone-engine Capstone up to 6.0.0-Alpha8. This issue affects the function cs_insn_name of the component M68K/RISCV Backends. Executing a manipulation can lead to out-of-bounds. The identification of this vulnerability is CVE-2026-49282. The attack can only be executed locally. There is no exploit available.

Detailsinfo

A vulnerability has been found in capstone-engine Capstone up to 6.0.0-Alpha8 and classified as problematic. This vulnerability affects the function cs_insn_name of the component M68K/RISCV Backends. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have missing or incomplete bounds checks. On a Capstone handle opened for M68K or RISCV, a caller-controlled invalid instruction ID can trigger an out-of-bounds read and crash the process. The demonstrated impact is availability loss in applications or bindings that expose instruction-name lookup to untrusted IDs. No code execution or data disclosure was demonstrated. Version 6.0.0-Alpha9 patches the issue.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-49282 since 05/28/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading to version 6.0.0-Alpha9 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• capstone-engine

Name

• Capstone

Version

• 6.0.0-Alpha8

Website

• Product: https://github.com/capstone-engine/capstone/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion