Skip to content

GHSA-8qp8-2vg2-8mr4 on CTRL-OS 26.05

Aliases: GHSA-8qp8-2vg2-8mr4

Packages: capstone

Status: Plausible

Advisory Information

Issue #1: ARM check_pop_return use-of-uninitialized-value

Field: Ecosystem Other

Field: Package name capstone

Field: Affected versions all versions through latest commit (2026)

Field: Patched versions none

Field: Severity Medium (5.5) — CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Field: Weaknesses (CWE) CWE-457: Use of Uninitialized Variable

Field: CVE identifier Leave blank (request CVE via GitHub after fix)

Field: Title ARM check_pop_return use-of-uninitialized-value

Field: Description

Location: ARMMapping.c:161 check_pop_return Sanitizer: MSan use-of-uninitialized-value PoC SHA256: f3643cdd7c7e8a8d98fefd630ffa1de9e3497a9d3b90d10541ee3f70065e4e66

Crash output is included as crash_capstone-42531197-arm-check-pop-return-msan.txt.

Issue #2: TMS320C64x DecodeCrosspathX3 use-of-uninitialized-value

Field: Ecosystem Other

Field: Package name capstone

Field: Affected versions all versions through latest commit (2026)

Field: Patched versions none

Field: Severity Medium (5.5) — CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Field: Weaknesses (CWE) CWE-457: Use of Uninitialized Variable

Field: CVE identifier Leave blank (request CVE via GitHub after fix)

Field: Title TMS320C64x DecodeCrosspathX3 use-of-uninitialized-value

Field: Description

Location: TMS320C64xDisassembler.c:561 DecodeCrosspathX3 Sanitizer: MSan use-of-uninitialized-value PoC SHA256: e0b4610382477c94efdb48047c1b747714f34caa3f6ac1ffd99e5135ffa75c48

Crash output is included as crash_capstone-42524177-tms320c64x-decodecrosspathx3-msan.txt.

PoC & Reproduction Materials

Full reproduction package (PoC binaries, crash logs, Dockerfile, replay harness):

https://anonymous.4open.science/r/capstone-reproduction-1B55/

Suggested fix

Review and fix the identified memory safety issue in the affected code path.

================================================================================ ATTACK SURFACE EXPANSION ASSESSMENT ================================================================================

MSan uninitialized-value issues — MEDIUM

Bug: Use of uninitialized value in ARM/TMS320C64x disassembly Impact: Information disclosure or logic errors in disassembly output

Escalation Path: 1. Uninitialized memory read in disassembly engine 2. If uninitialized value propagates to output -> info leak 3. Disassembly output used by security tools (binary analysis, IDS) 4. Incorrect disassembly -> missed vulnerabilities in analyzed binaries

Feasibility: MEDIUM - Capstone used in Ghidra, IDA Pro, radare2, QEMU, Unicorn engine, and numerous security research tools

Updates

2026-08-21 13:58 CEST

Metadata changes:

  • Status for package capstone: “Plausible”

2026-08-21 13:58 CEST

Metadata changes:

  • Status for package capstone: “New”