# capstone 5.0.9

Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.

Snapshot of gominimal/pkgs commit `75fcc0c216a965906cff4df6f7c16cf03acdca5b` (pushed 2026-08-23T17:32:57.000Z).

## Install

```sh
min add capstone
```

## Direct advisories

| ID | Severity | CVSS | Fix status | Fixed version | Summary |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-49263 | LOW | — | fixed | — | Capstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronization |
| CVE-2026-49282 | MEDIUM | 5.1 | fixed | — | Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes |
| CVE-2026-55893 | UNKNOWN | — | — | — | Capstone SH disassembler `set_reg_n` heap buffer overflow via crafted SH2A FPU bytecode |
| CVE-2026-55894 | UNKNOWN | — | — | — | Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode |
| GHSA-8qp8-2vg2-8mr4 | MEDIUM | 5.5 | unknown_fix | — | ARM check_pop_return use-of-uninitialized-value |

## Transitive advisories

2 advisories inherited through runtime dependencies:

- CVE-2026-5435 (HIGH) via glibc
- CVE-2026-6238 (MEDIUM) via glibc

## Dependencies

- Build (6): base, cmake, ninja, pkgconf, toolchain, glibc
- Runtime (1): glibc

## Scorecard

| Category | Score | Band |
| --- | --- | --- |
| supply-chain | 50 | mid |
| advisories | 25 | low |
| quality | 52 | mid |
| maintenance | 67 | mid |
| licence | 90 | good |

## Links

- Homepage: http://www.capstone-engine.org
- Package page (HTML): https://minimal.dev/pkgs/capstone
- JSON API (floats latest): https://minimal.dev/api/pkgs/capstone.json
- SBOM (CycloneDX 1.5): https://minimal.dev/api/pkgs/capstone/sbom.json