CVE-2026-49263 Capstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronization
Attacker-supplied WebAssembly bytes can cause infinite loops or parser desynchronization in Capstone, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-49263?
CVE-2026-49263 is a low-severity vulnerability in capstone-engine capstone, published on 14 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public `cs_disasm()` and `cs_disasm_iter()` APIs. For a large but well-formed `br_table` instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a `uint16_t` instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero and `cs_disasm()` can repeatedly decode the same instruction without advancing. For larger lengths, `cs_disasm_iter()` advances into the middle of the `br_table` payload and decodes target bytes as subsequent instructions. This is an availability and parser-integrity issue. Version 6.0.0-Alpha9 patches the issue.
Weakness: CWE-197
Which versions are affected by CVE-2026-49263?
How do I fix CVE-2026-49263?
Upgrade to a fixed version.
Is CVE-2026-49263 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49263 exists.
Sources
Also known as AZL-95979, AZL-96734, AZL-96743, BELL-CVE-2026-49263, DEBIAN-CVE-2026-49263, GHSA-5m9f-vqcm-g5pr and 1 more.