CVE-2026-49282

A flaw was found in Capstone. The cs_insn_name() application programming interface (API) in the M68K and RISCV backends does not properly validate caller-supplied instruction IDs. An attacker can provide an invalid instruction ID, leading to an out-of-bounds read. This can cause the process to crash, resulting in a denial of service (DoS) for applications that expose instruction-name lookup to untrusted IDs.

Moderate: This flaw in Capstone's M68K and RISCV backends can lead to a denial of service. Applications that utilize Capstone and expose the cs_insn_name() API to untrusted instruction IDs without proper validation are susceptible to an out-of-bounds read, resulting in a crash. The impact is limited to availability and does not involve code execution or information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.