CVE-2026-49282

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

CVE-2026-49282

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

CVE-2026-49282 Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

CVE-2026-49282

Capstone (disassembly framework) vulnerability CVE-2026-49282 affects builds prior to 6.0.0-Alpha9: the cs_insn_name() API forwards caller-provided instruction IDs to architecture backends, with M68K and RISCV backends lacking sufficient bounds checks. A caller-controlled invalid instruction ID o...

CVE-2026-49282

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public "csinsnname" API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends hav...

EUVD-2026-58744

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

CVE-2026-49282 Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

CVE-2026-49282 Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

CVE-2026-49282

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

PT-2026-72072

Name of the Vulnerable Software and Affected Versions Capstone versions prior to 6.0.0-Alpha9 Description The public cs insn name API forwards caller-supplied instruction IDs directly to the selected architecture backend. In the M68K and RISCV backends, missing or incomplete bounds checks allow a...

CVE-2026-49282: Out-of-bounds Read

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: m68k: mm: Move initrd phystovirt handling after paginginit When booting with an initial ramdisk on platforms where physical memory does not start at address zero e.g., on the Amiga: initrd: 0ef0602c - 0f800000 Zone ranges: DMA me...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013636)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013636 advisory. In the Linux kernel, the following vulnerability has been resolved: m68k: Only force 030 bus error if PC not in exception table getkernelnofault does copy data in...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013290)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013290 advisory. In the Linux kernel, the following vulnerability has been resolved: m68k: Only force 030 bus error if PC not in exception table getkernelnofault does copy data in...

PT-2026-41336

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=484248078 Crash type: Use-of-uninitialized-value Crash state: printAddressingMode M68K printInst cs disasm...

capstone:fuzz_disasmnext: Use-of-uninitialized-value in printAddressingMode

Detailed Report: https://oss-fuzz.com/testcase?key=5403361238384640 Project: capstone Fuzzing Engine: libFuzzer Fuzz Target: fuzzdisasmnext Job Type: libfuzzermsancapstone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: printAddressingMode M68KprintInst...

Linux Distros Unpatched Vulnerability : CVE-2023-54167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - m68k: mm: Move initrd phystovirt handling after paginginit When booting with an initial ramdisk on platforms where physical memory does not start at address zer...

Linux Distros Unpatched Vulnerability : CVE-2023-54232

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - m68k: Only force 030 bus error if PC not in exception table getkernelnofault does copy data in supervisor mode when forcing a task backtrace log through...

CVE-2023-54232

In the Linux kernel, the following vulnerability has been resolved: m68k: Only force 030 bus error if PC not in exception table getkernelnofault does copy data in supervisor mode when forcing a task backtrace log through /proc/sysrqtrigger. This is expected cause a bus error exception on e.g. NUL...

EUVD-2023-60474

In the Linux kernel, the following vulnerability has been resolved: m68k: mm: Move initrd phystovirt handling after paginginit When booting with an initial ramdisk on platforms where physical memory does not start at address zero e.g. on Amiga: initrd: 0ef0602c - 0f800000 Zone ranges: DMA mem...