Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public cs_disasm()… (CVE-2026-49263)

Capstone is a disassembly framework whose WebAssembly backend, before version 6.0.0-Alpha9, accepts attacker-controlled raw WASM instruction bytes via the public cs_disasm() and cs_disasm_iter() APIs. Specifically, for large but well-formed br_table instructions, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a uint16_t instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero, causing cs_disasm() to repeatedly decode the same instruction without advancing. For larger lengths, cs_disasm_iter() advances into the middle of the br_table payload and decodes target bytes as subsequent instructions. This results in an availability and parser-integrity issue. The vulnerability is fixed in version 6.0.0-Alpha9.

The vulnerability can cause the disassembler to enter a loop decoding the same instruction repeatedly or to misinterpret instruction bytes, potentially leading to denial of service or incorrect disassembly output. There is no indication of code execution or privilege escalation. The impact is limited to availability and parser integrity.

Upgrade to Capstone version 6.0.0-Alpha9 or later, where this issue is patched. No other mitigations are indicated.