# CVE-2026-49263

## Summary

- **CVE ID:** CVE-2026-49263
- **Severity:** LOW
- **CVSS Score:** 2 (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N)
- **CWE:** CWE-197
- **Published:** Aug 14, 2026
- **Last Modified:** Aug 17, 2026

## Description

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public `cs_disasm()` and `cs_disasm_iter()` APIs. For a large but well-formed `br_table` instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a `uint16_t` instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero and `cs_disasm()` can repeatedly decode the same instruction without advancing. For larger lengths, `cs_disasm_iter()` advances into the middle of the `br_table` payload and decodes target bytes as subsequent instructions. This is an availability and parser-integrity issue. Version 6.0.0-Alpha9 patches the issue.

## Affected Products

- capstone-engine — capstone (< 6.0.0-Alpha9)

## References

- [CNA](https://github.com/capstone-engine/capstone/security/advisories/GHSA-5m9f-vqcm-g5pr)
- [CNA](https://github.com/capstone-engine/capstone/blob/251c5bb4bc9bb92973e738ae3c5f4ef86f103356/ChangeLog#L102)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.13%
- **EPSS Percentile:** 2.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._