Prior to version 6.0.0-Alpha9, Capstone's public cs_insn_name() API forwards caller-supplied instruction IDs directly to the selected architecture… (CVE-2026-49282)
Description
Capstone versions prior to 6.0.0-Alpha9 have a vulnerability in the cs_insn_name() API where invalid instruction IDs can cause out-of-bounds reads in the M68K and RISCV backends. This can lead to process crashes and availability loss. The issue is patched in version 6.0.0-Alpha9. No code execution or data disclosure has been demonstrated.
CVSS v3.1
Score 5.1medium
Affected software
pkg:deb/ubuntu/capstone?arch=source&distro=xenialpkg:deb/ubuntu/capstone?arch=source&distro=bionicpkg:deb/ubuntu/capstone?arch=source&distro=focalpkg:deb/ubuntu/capstone?arch=source&distro=jammypkg:deb/ubuntu/capstone?arch=source&distro=noblepkg:deb/ubuntu/capstone?arch=source&distro=stonkingpkg:deb/ubuntu/capstone?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Capstone is a disassembly framework. Before version 6.0.0-Alpha9, the public cs_insn_name() API forwards caller-supplied instruction IDs directly to the architecture backend. While most backends validate these IDs, the M68K and RISCV backends lack complete bounds checking. This allows an attacker to supply invalid instruction IDs that trigger out-of-bounds reads, causing the process to crash. The vulnerability impacts availability but does not allow code execution or data leakage. The issue is fixed in version 6.0.0-Alpha9.
Potential Impact
The vulnerability causes an out-of-bounds read leading to process crashes when invalid instruction IDs are supplied to the cs_insn_name() API on M68K or RISCV backends. This results in denial of service (availability loss) in applications exposing this functionality. There is no evidence of code execution or data disclosure.
Mitigation Recommendations
Upgrade to Capstone version 6.0.0-Alpha9 or later, where the issue is patched. Until then, avoid exposing the cs_insn_name() API to untrusted instruction IDs on M68K or RISCV architectures.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-49282
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f61a2cdf04f656664185
Added to database: 10/17/2026, 22:26:34 UTC
Last enriched: 10/18/2026, 01:04:07 UTC
Last updated: 10/18/2026, 01:04:07 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.