CVE-2026-49263: falha de baixa gravidade em capstone-engine capstone
Capstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronization
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2epss 0.2%
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public `cs_disasm()` and `cs_disasm_iter()` APIs. For a large but well-formed `br_table` instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a `uint16_t` instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero and `cs_disasm()` can repeatedly decode the same instruction without advancing. For larger lengths, `cs_disasm_iter()` advances into the middle of the `br_table` payload and decodes target bytes as subsequent instructions. This is an availability and parser-integrity issue. Version 6.0.0-Alpha9 patches the issue.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
capstone-engine · capstoneCVEs relacionadas — capstone-engine capstone
No mesmo produto, das mais perigosas para as menos.
CVE-2026-47143MEDIUMCapstone has a NULL Pointer Dereference with 3DNow! opcodesEPSS 0.5%CVE-2025-67873MEDIUMCapstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflowEPSS 0.2%CVE-2025-68114MEDIUMCapstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflowEPSS 0.2%CVE-2026-55894MEDIUMCapstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecodeEPSS 0.2%CVE-2026-55893HIGHCapstone SH disassembler `set_reg_n` heap buffer overflow via crafted SH2A FPU bytecodeEPSS 0.2%CVE-2026-49282MEDIUMCapstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashesEPSS 0.2%