Skip to content
OpenAdvisories
Medium RHSA-2026:81540 2 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Oct 14, 2026 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 5

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 capstone 0:5.0.8-0.5.hum1
Red Hat · Hardened Images 1 hummingbird:1 capstone-devel 0:5.0.8-0.5.hum1
Red Hat · Hardened Images 1 hummingbird:1 capstone-java 0:5.0.8-0.5.hum1
Red Hat · Hardened Images 1 hummingbird:1 capstone-static 0:5.0.8-0.5.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3-capstone 0:5.0.8-0.5.hum1

Vulnerabilities 2

  • Medium 5.1
    CVE-2026-49282

    Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes

    Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name t…

    capstone-engine capstone rust capstone Debian Ubuntu Azure Linux
  • Low 2.0
    CVE-2026-49263

    Capstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronization

    Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public `cs_disasm()` and `cs_disasm_iter()` APIs. For a large but well-formed `br_table` inst…

    capstone-engine capstone rust capstone Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-49263
  • report
    https://access.redhat.com/security/cve/CVE-2026-49282
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_81540.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516114
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-49263
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-49263
  • article
    https://github.com/capstone-engine/capstone/blob/251c5bb4bc9bb92973e738ae3c5f4ef86f103356/ChangeLog#L102
  • article
    https://github.com/capstone-engine/capstone/security/advisories/GHSA-5m9f-vqcm-g5pr
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516103
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-49282
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-49282
  • article
    https://github.com/capstone-engine/capstone/security/advisories/GHSA-jrw4-wj52-2vw8