Heap Overflow in Capstone Disassembly Framework

Executive Summary

This vulnerability affects Capstone's WebAssembly backend in versions prior to 6.0.0-Alpha9. It involves a flaw in handling the `br_table` instruction where attacker-controlled raw WASM instruction bytes can cause instruction-size truncation. The issue occurs because the decoder uses a wider local variable to accumulate the immediate length but returns it through a 16-bit `uint16_t` path. When the instruction length is exactly 65,536 bytes, the size wraps to zero, causing `cs_disasm()` to repeatedly decode the same instruction without advancing. For larger lengths, `cs_disasm_iter()` advances into the middle of the `br_table` payload, decoding target bytes as subsequent instructions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Capstone disassembly framework's WebAssembly backend. Detection requires checking if your system uses a vulnerable version of Capstone (prior to 6.0.0-Alpha9). Inspect installed Capstone versions via package managers or Capstone's API. No direct network detection commands are applicable as this is a library-level issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to an availability issue and parser-integrity problem. An attacker could exploit it to cause infinite loops or incorrect instruction streams in tools that rely on Capstone for parsing untrusted WebAssembly. This may result in system resource exhaustion or misleading analysis results for affected applications.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Capstone to version 6.0.0-Alpha9 or later to patch the vulnerability. If upgrading is not immediately possible, avoid using Capstone's WebAssembly backend with untrusted input or disable WebAssembly parsing features in tools that rely on Capstone.

Useful 0 Not Useful 0