Read the docs
TI-2026-36458 Aliases CVE-2026-49263

Capstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronization

Priority MEDIUM 44CWE-197Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Partial Red Hat: 1 fixed, 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public `cs_disasm()` and `cs_disasm_iter()` APIs. For a large but well-formed `br_table` instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a `uint16_t` instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero and `cs_disasm()` can repeatedly decode the same instruction without advancing. For larger lengths, `cs_disasm_iter()` advances into the middle of the `br_table` payload and decodes target bytes as subsequent instructions. This is an availability and parser-integrity issue. Version 6.0.0-Alpha9 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00171 6th percentileScored 2026-11-07
Fix Partial capstone (capstone-engine): 6.0.0-Alpha9Red Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
capstone-enginecapstonebefore 6.0.0-Alpha96.0.0-Alpha9Patch availableCNA
  • capstone Vendorcapstone-engine Affected before 6.0.0-Alpha9 Fixed in 6.0.0-Alpha9 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:capstone-engine:capstone:*:*:*:*:*:*:*:*——capstone-engine
  • cpe:2.3:a:capstone-engine:capstone:*:*:*:*:*:*:*:* Versions — — ·capstone-engine

Remediation

  • Fix · CNA capstone (capstone-engine) Fixed in 6.0.0-Alpha9

Red Hat 1 advisory

  • RHSA-2026:81540 Released 2026-10-12 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images capstone-5.0.8-0.5.hum1@aarch64, capstone-5.0.8-0.5.hum1@s390x, capstone-5.0.8-0.5.hum1@src +13

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:81540

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49263
  2. 2026-10-13 Fix available: RHSA-2026:81540 · Red Hat
  3. 2026-10-13 Fix available: Red Hat Hardened Images · Red Hat
  4. 2026-11-06 Affected versions changed · Red Hat

References

Other 2

  • TI-2025-41703 Capstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflow CVSS 3.1CRITICAL 9.8
  • TI-2025-41500 Capstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflow CVSS 3.1HIGH 7.8
  • TI-2026-40345 Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode CVSS 4.0MEDIUM 6.8
  • TI-2026-34733 Capstone has a NULL Pointer Dereference with 3DNow! opcodes CVSS 3.1MEDIUM 5.9
  • TI-2026-36469 Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes CVSS 3.1MEDIUM 5.1
  • TI-2017-04662 Integer overflow in the cs_winkernel_malloc function in winkernel_mm.c in Capstone 3.0.4… CVSS 3.0HIGH 8.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences