Executive brief
Capstone is a widely-used disassembly framework that converts machine code into human-readable instructions. The cs_insn_name() function, which looks up instruction names, lacks proper input validation in its M68K and RISCV backends. An attacker who can supply arbitrary instruction IDs to this function can crash the application by triggering an out-of-bounds memory read, causing a denial of service.
Technical details
The vulnerability is an out-of-bounds read in the M68K and RISCV instruction-name lookup backends. The M68K backend directly indexes a fixed-size instruction-name table without checking the caller-supplied ID against the table bounds, while the RISCV backend has an incomplete range check that allows underflow of an unsigned index. An unauthenticated attacker with the ability to call cs_insn_name() with arbitrary instruction IDs can trigger a crash. No code execution or data disclosure has been demonstrated. The issue is patched in version 6.0.0-Alpha9.
Affected products
- Capstone Capstone before 6.0.0-Alpha9
Timeline
- 2026-05-27: disclosed
- 2026-06: patched: Version 6.0.0-Alpha9