CVE-2026-49282

What it is

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have missing or incomplete bounds checks. On a Capstone handle opened for M68K or RISCV, a caller-controlled invalid instruction ID can trigger an out-of-bounds read and crash the process. The demonstrated impact is availability loss in applications or bindings that expose instruction-name lookup to untrusted IDs. No code execution or data disclosure was demonstrated. Version 6.0.0-Alpha9 patches the issue.

At a glance

Exploitability

Can be exploited locally on the machine without logging in. Limited direct impact.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-08-14 18:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-18 20:05 UTC Last updatedMost recent change to the record

Details

Published

2026-08-14 18:17 UTC

Last modified

2026-09-18 20:05 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-125 · Out-of-bounds read

Record status

Awaiting Analysis

Attack profile CVSS 3.1 · 5.1

Attack vector

Local

Complexity

Low

Privileges needed

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low