Issue #1: ARM check_pop_return use-of-uninitialized-value

Field: Ecosystem
Other

Field: Package name
capstone

Field: Affected versions
all versions through latest commit (2026)

Field: Patched versions
none

Field: Severity
Medium (5.5) — CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Field: Weaknesses (CWE)
CWE-457: Use of Uninitialized Variable

Field: CVE identifier
Leave blank (request CVE via GitHub after fix)

Field: Title
ARM check_pop_return use-of-uninitialized-value

Field: Description

Location: ARMMapping.c:161 check_pop_return
Sanitizer: MSan use-of-uninitialized-value
PoC SHA256: f3643cdd7c7e8a8d98fefd630ffa1de9e3497a9d3b90d10541ee3f70065e4e66

Crash output is included as crash_capstone-42531197-arm-check-pop-return-msan.txt.

Issue #2: TMS320C64x DecodeCrosspathX3 use-of-uninitialized-value

Field: Ecosystem
Other

Field: Package name
capstone

Field: Affected versions
all versions through latest commit (2026)

Field: Patched versions
none

Field: Severity
Medium (5.5) — CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Field: Weaknesses (CWE)
CWE-457: Use of Uninitialized Variable

Field: CVE identifier
Leave blank (request CVE via GitHub after fix)

Field: Title
TMS320C64x DecodeCrosspathX3 use-of-uninitialized-value

Field: Description

Location: TMS320C64xDisassembler.c:561 DecodeCrosspathX3
Sanitizer: MSan use-of-uninitialized-value
PoC SHA256: e0b4610382477c94efdb48047c1b747714f34caa3f6ac1ffd99e5135ffa75c48

Crash output is included as crash_capstone-42524177-tms320c64x-decodecrosspathx3-msan.txt.

PoC & Reproduction Materials

Full reproduction package (PoC binaries, crash logs, Dockerfile, replay harness):

https://anonymous.4open.science/r/capstone-reproduction-1B55/

Suggested fix

Review and fix the identified memory safety issue in the affected code path.

================================================================================
ATTACK SURFACE EXPANSION ASSESSMENT

MSan uninitialized-value issues — MEDIUM

Bug: Use of uninitialized value in ARM/TMS320C64x disassembly
Impact: Information disclosure or logic errors in disassembly output

Escalation Path:

1. Uninitialized memory read in disassembly engine
2. If uninitialized value propagates to output -> info leak
3. Disassembly output used by security tools (binary analysis, IDS)
4. Incorrect disassembly -> missed vulnerabilities in analyzed binaries

Feasibility: MEDIUM - Capstone used in Ghidra, IDA Pro, radare2,
QEMU, Unicorn engine, and numerous security research tools