CyberRota Analysis
AI-GeneratedThe Capstone disassembly framework's WebAssembly backend prior to version 6.0.0-Alpha9 is vulnerable to a denial-of-service condition due to improper handling of large `br_table` instruction lengths, which can cause the decoder to loop indefinitely or misinterpret subsequent instruction bytes. This vulnerability affects the integrity of the parser and can lead to application crashes or degraded performance. Developers and security teams using affected versions should prioritize updating to the patched version to mitigate potential availability issues.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public `cs_disasm()` and `cs_disasm_iter()` APIs. For a large but well-formed `br_table` instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a `uint16_t` instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero and `cs_disasm()` can repeatedly decode the same instruction without advancing. For larger lengths, `cs_disasm_iter()` advances into the middle of the `br_table` payload and decodes target bytes as subsequent instructions. This is an availability and parser-integrity issue. Version 6.0.0-Alpha9 patches the issue.