CVE-2026-49282

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have missing or incomplete bounds checks. On a Capstone handle opened for M68K or RISCV, a caller-controlled invalid instruction ID can trigger an out-of-bounds read and crash the process. The demonstrated impact is availability loss in applications or bindings that expose instruction-name lookup to untrusted IDs. No code execution or data disclosure was demonstrated. Version 6.0.0-Alpha9 patches the issue.

• CWE-125
• CWE-129
• CWE-191

• https://github.com/capstone-engine/capstone/blob/251c5bb4bc9bb92973e738ae3c5f4ef86f103356/ChangeLog#L102
• https://github.com/capstone-engine/capstone/security/advisories/GHSA-jrw4-wj52-2vw8
• https://github.com/capstone-engine/capstone/security/advisories/GHSA-jrw4-wj52-2vw8

Published

Aug 14, 2026

Last Modified

Sep 18, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49274Kirby is an open-source content management system. Prior to …5.3
• CVE-2026-49276Kirby is an open-source content management system. Prior to …7.4
• CVE-2026-49277Rocket.Chat is an open-source, secure, fully customizable co…2.3
• CVE-2026-49278Rocket.Chat is an open-source, secure, fully customizable co…6.7
• CVE-2026-49279WWBN AVideo is an open source video platform. Versions 29.0 …7.7
• CVE-2026-4928Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-49283The SimpleSAMLphp SAML2 library is a PHP library for SAML2 r…8.7
• CVE-2026-49284SimpleSAMLphp versions before 1.18.6 contain an information …7.1
• CVE-2026-49286PhpWeasyPrint is a PHP library allowing PDF generation from …8.1
• CVE-2026-49287Statamic is a Laravel and Git powered content management sys…7.4
• CVE-2026-49288Statamic is a Laravel and Git powered content management sys…4.3
• CVE-2026-49289The SimpleSAMLphp SAML2 library is a PHP library for SAML2 r…7.5