CVE-2026-49282

Katalog CVE KUTIM-CSIRT

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-49282

Katalog CVE

CVSS 5.1 · Medium EPSS 0,18%

Kerentanan Out-of-bounds Read. Skor CVSS 3.1 5.1 (Medium) menurut github.com.

Deskripsi (NVD)

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have missing or incomplete bounds checks. On a Capstone handle opened for M68K or RISCV, a caller-controlled invalid instruction ID can trigger an out-of-bounds read and crash the process. The demonstrated impact is availability loss in applications or bindings that expose instruction-name lookup to untrusted IDs. No code execution or data disclosure was demonstrated. Version 6.0.0-Alpha9 patches the issue.

Rincian

Terbit di NVD
14 Agustus 2026
Terakhir diubah
18 September 2026
Status NVD
Awaiting Analysis
CVSS 3.1
5.1 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-125: Out-of-bounds Read
CWE-129: Improper Validation of Array Index
CWE-191: Integer Underflow (Wrap or Wraparound)
EPSS (30 hari)
0,18% peluang dieksploitasi; lebih tinggi dari 6,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.