Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have missing or incomplete bounds checks. On a Capstone handle opened for M68K or RISCV, a caller-controlled invalid instruction ID can trigger an out-of-bounds read and crash the process. The demonstrated impact is availability loss in applications or bindings that expose instruction-name lookup to untrusted IDs. No code execution or data disclosure was demonstrated. Version 6.0.0-Alpha9 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-49282 Out-of-Bounds Read in Capstone 6.0.0-Alpha9 via M68K/RISCV Backends https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49282
Post summary
A brief note reporting an out‑of‑bounds read vulnerability in Capstone 6.0.0‑Alpha9 affecting M68K/RISCV backends, with a link to further details on Vulmon.
🚨*CVE* CVE-2026-49282 Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the se… https://www.cve.org/CVERecord?id=CVE-2026-49282 ----- Traducción: CVE-2026-49282 Cap… https://infoflow.cloud`
Post summary
The post announces CVE-2026-49282 affecting Capstone's `cs_insn_name()` API, providing a brief technical note but no evidence of exploitation, patches, or PoC.
CVE-2026-49282 Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the se… https://www.cve.org/CVERecord?id=CVE-2026-49282
Post summary
The text announces CVE‑2026‑49282, noting a flaw in Capstone’s cs_insn_name() API that may allow exploitation; it provides some technical detail but no PoC, exploit, or patch information.