Capstone’s public API function cs_insn_name() forwards supplied instruction IDs directly to the chosen architecture backend. The M68K and RISCV backends lack proper bounds checking, so a caller can pass an invalid ID that triggers an out-of-bounds read when the backend indexes its instruction-name tables. The only demonstrated outcome is a process crash, resulting in an availability loss for applications or bindings that use cs_insn_name() with untrusted input. No remote code execution or data disclosure has been shown, and the weakness is categorized as an out-of-bounds read and integer validation vulnerability (CWE-125, CWE-129, CWE-191).

The affected product is the Capstone disassembly engine maintained by capstone-engine:capstone. All releases before 6.0.0-Alpha9 are vulnerable when a handle is opened for the M68K or RISCV architecture. Users running Capstone with these backends should verify whether their applications supply instruction IDs that might be out of bounds, and plan to upgrade the library.

The CVSS score of 5.1 classifies the vulnerability as moderate, and the EPSS score is not available. Because the exploit requires an attacker to control the instruction ID passed to cs_insn_name(), the attack vector is likely local or confined to a component with untrusted input. Although the impact is limited to denial of service via a crash, the lack of mitigation in the backend means the vulnerability could be easily triggered. The issue is not listed in the CISA KEV catalog, suggesting no confirmed exploits yet, but the moderate severity warrants immediate remediation.