Out-of-Bounds Read Vulnerability in Capstone Disassembly Framework Affecting M68K and RISCV Architectures

CVE-2026-49282

What is CVE-2026-49282?

The Capstone Disassembly Framework is subject to an out-of-bounds read vulnerability when handling invalid instruction IDs for M68K and RISCV architectures. This issue arises from the lack of proper bounds checking in these specific architecture backends. When a caller supplies an invalid instruction ID, it can cause the application to read data from unintended memory locations, potentially leading to crashes and loss of availability in systems that process untrusted input. Available in versions prior to 6.0.0-Alpha9, this vulnerability underscores the importance of robust validation in API implementations.

References