CVE-2026-49263

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...

capstone/fuzz_disasmnext: Index-out-of-bounds in printVectorIndex

Detailed report: https://oss-fuzz.com/testcase?key=5644198205718528 Project: capstone Fuzzer: libFuzzercapstonefuzzdisasmnext Fuzz target binary: fuzzdisasmnext Job Type: libfuzzerubsancapstone Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: printVectorIndex...

capstone/fuzz_disasmmaster: Use-of-uninitialized-value in update_pub_insn

Detailed report: https://oss-fuzz.com/testcase?key=5956930588639232 Project: capstone Fuzzer: libFuzzercapstonefuzzdisasmmaster Fuzz target binary: fuzzdisasmmaster Job Type: libfuzzermsancapstone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: updatepubinsn...