Disassembly Framework Vulnerability in Capstone WebAssembly Backend
CVE-2026-49263

2LOW

Key Information:

Vendor

Capstone-engine

Status
Capstone
Vendor
CVE Published:
14 August 2026

What is CVE-2026-49263?

Capstone is a widely-used disassembly framework that encountered a vulnerability within its WebAssembly backend. Prior to the release of version 6.0.0-Alpha9, an issue allowed the cs_disasm() and cs_disasm_iter() APIs to accept attacker-controlled raw WASM instruction bytes. This could result in a situation where a crafted large br_table instruction could cause the decoder to mismanage the instruction length, leading to repeated decoding of the same instruction without progression. In cases of larger instruction lengths, the decoder could incorrectly interpret parts of the br_table payload as additional instructions, effectively compromising parser integrity and availability. This issue has been addressed in version 6.0.0-Alpha9.

Affected Version(s)

capstone < 6.0.0-Alpha9

References

https://github.com/capstone-engine/capstone/security/advi...
x_refsource_CONFIRM
https://github.com/capstone-engine/capstone/blob/251c5bb4...
x_refsource_MISC

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.