EUVD-2026-58747Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L per official vector; AC:H because exact 65536-byte br_table is a precise trigger condition; UI:R because the application must actively process the malicious input buffer.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public cs_disasm() and cs_disasm_iter() APIs. For a large but well-formed br_table instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a uint16_t instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero and cs_disasm() can repeatedly decode the same instruction without advancing. For larger lengths, cs_disasm_iter() advances into the middle of the br_table payload and decodes target bytes as subsequent instructions. This is an availability and parser-integrity issue. Version 6.0.0-Alpha9 patches the issue.
AnalysisAI
Integer truncation in Capstone's WebAssembly disassembly backend allows a crafted br_table instruction to cause either an infinite decode loop or misaligned parser advancement, undermining both availability and parser integrity in any application that passes attacker-controlled WASM bytes to cs_disasm() or cs_disasm_iter(). All Capstone versions prior to 6.0.0-Alpha9 are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three specific conditions to hold simultaneously: (1) the target application links against a Capstone build that includes the WebAssembly backend (CS_ARCH_WASM compiled in), (2) the application calls cs_disasm() or cs_disasm_iter() on attacker-controlled byte sequences without first enforcing a maximum input length below 65,536 bytes, and (3) the attacker can supply a br_table instruction whose encoded immediate field meets the threshold (exactly 65,536 bytes for the infinite-loop path, or a larger value for the parser-misalignment path). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Capstone to version 6.0.0-Alpha9 or later, which contains the fix for the uint16_t truncation in the WASM backend, as confirmed by the upstream changelog (https://github.com/capstone-engine/capstone/blob/251c5bb4bc9bb92973e738ae3c5f4ef86f103356/ChangeLog#L102) and security advisory GHSA-5m9f-vqcm-g5pr (https://github.com/capstone-engine/capstone/security/advisories/GHSA-5m9f-vqcm-g5pr). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-197 – Numeric Truncation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today