CVE-2026-49263

Name of the Vulnerable Software and Affected Versions Capstone versions prior to 6.0.0-Alpha9

Description The WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the cs disasm() and cs disasm iter() APIs. When processing a large but well-formed br table instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it via a uint16 t instruction-size path. If the encoded instruction length is exactly 65,536 bytes, the size wraps to zero, causing cs disasm() to repeatedly decode the same instruction without advancing. For lengths exceeding this value, cs disasm iter() advances into the middle of the br table payload and decodes target bytes as subsequent instructions, leading to an availability and parser-integrity issue.

Recommendations Update to version 6.0.0-Alpha9.