Capstone's WebAssembly backend prior to version 6.0.0-Alpha9 accepts attacker-controlled raw WASM instruction bytes via public APIs cs_disasm() and cs_disasm_iter(). For a large but well-formed br_table instruction, the decoder accumulates the immediate length in a wider variable but returns it through a uint16_t path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero causing cs_disasm() to repeatedly decode the same instruction without advancing. For larger lengths, cs_disasm_iter() advances into the middle of the br_table payload, decoding target bytes as subsequent instructions. This causes availability and parser-integrity issues. The vulnerability is fixed in version 6.0.0-Alpha9.

The vulnerability can cause denial of service by making the disassembler repeatedly decode the same instruction or misinterpret instruction boundaries, affecting availability and parser integrity. The CVSS 4.0 score is low (2.0), reflecting limited impact and local attack vector with partial user interaction required.

The issue is patched in capstone version 6.0.0-Alpha9. Users should upgrade to this version or later to remediate the vulnerability. No other vendor advisories or temporary mitigations are provided.