A numeric truncation bug in Capstone’s WebAssembly backend lets an attacker supply a specially crafted br_table instruction that either causes the disassembler to stall or to misinterpret subsequent bytes as separate instructions. The bug leads to an infinite decoding loop or to a corrupted parsing state, which can exhaust CPU or memory resources and result in a denial‑of‑service condition. The CVSS score of 2.0 reflects a low base severity but the potential for continuous resource exhaustion should not be underestimated.

The vulnerability affects the Capstone Engine’s Capstone disassembly library built before version 6.0.0‑Alpha9. Any deployment that links against an older Capstone core and exposes the public cs_disasm() or cs_disasm_iter() functions to untrusted input is at risk. Upgrading to the patched 6.0.0‑Alpha9 release provides the fix.

The vulnerability requires the ability to inject arbitrary WebAssembly bytes into the disassembly API, so it can be triggered by any component that processes user‑supplied WASM code. While it does not provide code execution, it can be leveraged to flood the system with large br_table payloads, causing the decoder to repeatedly parse the same instruction or to walk into the payload payload region. With no EPSS score available and the issue not listed in KEV, the likelihood of widespread exploitation is currently unknown, but the DoS potential warrants proactive mitigation.