CVE-2026-49282: falha de média gravidade em capstone-engine capstone
Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.2%
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have missing or incomplete bounds checks. On a Capstone handle opened for M68K or RISCV, a caller-controlled invalid instruction ID can trigger an out-of-bounds read and crash the process. The demonstrated impact is availability loss in applications or bindings that expose instruction-name lookup to untrusted IDs. No code execution or data disclosure was demonstrated. Version 6.0.0-Alpha9 patches the issue.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Produtos afetados
capstone-engine · capstoneCVEs relacionadas — capstone-engine capstone
No mesmo produto, das mais perigosas para as menos.
CVE-2026-47143MEDIUMCapstone has a NULL Pointer Dereference with 3DNow! opcodesEPSS 0.5%CVE-2025-67873MEDIUMCapstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflowEPSS 0.2%CVE-2025-68114MEDIUMCapstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflowEPSS 0.2%CVE-2026-55894MEDIUMCapstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecodeEPSS 0.2%CVE-2026-55893HIGHCapstone SH disassembler `set_reg_n` heap buffer overflow via crafted SH2A FPU bytecodeEPSS 0.2%CVE-2026-49263LOWCapstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronizationEPSS 0.2%