CVE-2026-49263

A flaw was found in Capstone, a disassembly framework, affecting its WebAssembly (WASM) backend. A remote attacker could exploit this by providing a specially crafted br_table instruction. This could lead to a denial of service, where the disassembler gets stuck in a loop, or cause parser desynchronization, leading to incorrect disassembly of subsequent instructions. This issue impacts the availability and integrity of the disassembler.

A flaw of moderate impact was found in the Capstone disassembly framework's WebAssembly (WASM) backend, which is shipped in Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift (via the RHEL CoreOS 9 container image), as well as in Fedora, EPEL, and Red Hat Hardened Images community offerings and community packages that bundle Capstone (such as imhex and pe-bear). Capstone's WASM decoder accepts attacker-controlled raw WASM instruction bytes through the public cs_disasm() and cs_disasm_iter() APIs. For a large but well-formed br_table instruction, the decoder accumulates the immediate length in a wider local variable but returns it through a uint16_t instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero and cs_disasm() can repeatedly decode the same instruction without advancing, causing a denial of service; for larger lengths, cs_disasm_iter() advances into the middle of the br_table payload and decodes target bytes as subsequent instructions, causing parser desynchronization and incorrect disassembly output. The flaw affects the availability and, to a lesser degree, the integrity of applications that use Capstone to disassemble attacker-controlled WASM content; there is no known confidentiality impact. Red Hat rated this flaw Moderate severity (CVSS 3.1 score 6.8), which is higher than the Low rating in the upstream CVEORG record; the difference stems from differing CVSS metric assessments between the issuers. For Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift RHEL CoreOS 9, the fix is currently deferred: exploitation requires an application to pass attacker-controlled WASM bytes to the affected disassembly APIs, so the residual risk is limited to denial of service or incorrect disassembly in such applications. For the community (Fedora, EPEL) and Red Hat Hardened Images offerings, a fix is being pursued through the delegated maintenance process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Upgrading to Capstone 6.0.0-Alpha9, which contains the upstream fix, addresses this issue.