CVE-2026-49282 Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes
Attackers can crash applications using Capstone's M68K or RISCV backends by supplying invalid instruction IDs to the name lookup API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49282?
CVE-2026-49282 is a medium-severity denial of service vulnerability in capstone-engine capstone, published on 14 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have missing or incomplete bounds checks. On a Capstone handle opened for M68K or RISCV, a caller-controlled invalid instruction ID can trigger an out-of-bounds read and crash the process. The demonstrated impact is availability loss in applications or bindings that expose instruction-name lookup to untrusted IDs. No code execution or data disclosure was demonstrated. Version 6.0.0-Alpha9 patches the issue.
Which versions are affected by CVE-2026-49282?
How do I fix CVE-2026-49282?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-49282 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49282 exists.
Sources
Also known as AZL-95982, AZL-96737, AZL-96746, BELL-CVE-2026-49282, DEBIAN-CVE-2026-49282, GHSA-jrw4-wj52-2vw8 and 1 more.