Hi,

The following vulnerability was published for capstone.

CVE-2026-49263[0]:
| Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9,
| Capstone's WebAssembly backend accepts attacker-controlled raw WASM
| instruction bytes through the public `cs_disasm()` and
| `cs_disasm_iter()` APIs. For a large but well-formed `br_table`
| instruction, the WASM decoder accumulates the immediate length in a
| wider local variable but returns it through a `uint16_t`
| instruction-size path. When the encoded instruction length is
| exactly 65,536 bytes, the size wraps to zero and `cs_disasm()` can
| repeatedly decode the same instruction without advancing. For larger
| lengths, `cs_disasm_iter()` advances into the middle of the
| `br_table` payload and decodes target bytes as subsequent
| instructions. This is an availability and parser-integrity issue.
| Version 6.0.0-Alpha9 patches the issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-49263
https://www.cve.org/CVERecord?id=CVE-2026-49263
[1] https://github.com/capstone-engine/capstone/security/advisories/GHSA-5m9f-vqcm-g5pr

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore