CVE-2026-49263: CWE-197: Numeric Truncation Error in capstone-engine capstone
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public `cs_disasm()` and `cs_disasm_iter()` APIs. For a large but well-formed `br_table` instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a `uint16_t` instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero and `cs_disasm()` can repeatedly decode the same instruction without advancing. For larger lengths, `cs_disasm_iter()` advances into the middle of the `br_table` payload and decodes target bytes as subsequent instructions. This is an availability and parser-integrity issue. Version 6.0.0-Alpha9 patches the issue.
AI Analysis
Technical Summary
Capstone before version 6.0.0-Alpha9 has a numeric truncation error (CWE-197) in its WebAssembly backend when decoding large br_table instructions. The immediate length is accumulated in a wider variable but returned through a uint16_t path, causing a wraparound at exactly 65,536 bytes. This results in cs_disasm() repeatedly decoding the same instruction without advancing, or cs_disasm_iter() advancing incorrectly into the payload, compromising parser integrity and availability. Version 6.0.0-Alpha9 addresses this issue.
Potential Impact
The vulnerability can cause denial of service by making the disassembler loop indefinitely or misinterpret instructions, affecting availability and parser integrity. There is no indication of code execution or data disclosure. The CVSS score is low (2.0), reflecting limited impact.
Mitigation Recommendations
Version 6.0.0-Alpha9 of capstone fixes this vulnerability. Users should upgrade to this version or later to remediate the issue. No other mitigation or workaround is indicated.
CVE-2026-49263: CWE-197: Numeric Truncation Error in capstone-engine capstone
Description
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public `cs_disasm()` and `cs_disasm_iter()` APIs. For a large but well-formed `br_table` instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a `uint16_t` instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero and `cs_disasm()` can repeatedly decode the same instruction without advancing. For larger lengths, `cs_disasm_iter()` advances into the middle of the `br_table` payload and decodes target bytes as subsequent instructions. This is an availability and parser-integrity issue. Version 6.0.0-Alpha9 patches the issue.
CVSS v4.0
Score 2.0low
Affected software
pkg:github/capstone-engine/capstoneRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Capstone before version 6.0.0-Alpha9 has a numeric truncation error (CWE-197) in its WebAssembly backend when decoding large br_table instructions. The immediate length is accumulated in a wider variable but returned through a uint16_t path, causing a wraparound at exactly 65,536 bytes. This results in cs_disasm() repeatedly decoding the same instruction without advancing, or cs_disasm_iter() advancing incorrectly into the payload, compromising parser integrity and availability. Version 6.0.0-Alpha9 addresses this issue.
Potential Impact
The vulnerability can cause denial of service by making the disassembler loop indefinitely or misinterpret instructions, affecting availability and parser integrity. There is no indication of code execution or data disclosure. The CVSS score is low (2.0), reflecting limited impact.
Mitigation Recommendations
Version 6.0.0-Alpha9 of capstone fixes this vulnerability. Users should upgrade to this version or later to remediate the issue. No other mitigation or workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-28T14:33:01.180Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7f5a78bf8831d539821052
Added to database: 08/14/2026, 18:12:08 UTC
Last enriched: 08/22/2026, 13:14:17 UTC
Last updated: 09/07/2026, 10:52:09 UTC
Views: 53
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.