Capstone's cs_insn_name() API forwards caller-supplied instruction IDs to architecture backends. While most backends validate these IDs, M68K and RISCV backends lack complete bounds checking, resulting in out-of-bounds reads when invalid instruction IDs are used. This can cause process crashes on handles opened for these architectures. The vulnerability affects versions prior to 6.0.0-Alpha9, which includes the affected version =6.0.0-Alpha9 as stated. The demonstrated impact is limited to availability loss; no code execution or data leakage has been shown.

The vulnerability causes an out-of-bounds read that can crash the process using the capstone disassembly framework with M68K or RISCV backends. This results in denial of service (availability loss) in applications or bindings exposing instruction-name lookups to untrusted inputs. There is no evidence of code execution or data disclosure.

Version 6.0.0-Alpha9 of capstone patches this vulnerability. Users should upgrade to this version or later to remediate the issue. Patch status is not explicitly confirmed beyond the version mention, so verify with the vendor advisory for current remediation guidance.