CVE-2025-67873

EUVD-2025-203996
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.8 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 1%
Affected Products (NVD)
VendorProductVersion
capstone-enginecapstone
𝑥
< 6.0.0
capstone-enginecapstone
6.0.0:alpha1
capstone-enginecapstone
6.0.0:alpha2
capstone-enginecapstone
6.0.0:alpha3
capstone-enginecapstone
6.0.0:alpha4
capstone-enginecapstone
6.0.0:alpha5
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
capstone
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
plucky
ignored
questing
needs-triage
resolute
needs-triage
xenial
ignored
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
capstone
RHEL 9
0:4.0.2-11.el9_7
fixed
capstone-devel
RHEL 9
0:4.0.2-11.el9_7
fixed
capstone-java
RHEL 9
0:4.0.2-11.el9_7
fixed
python3-capstone
RHEL 9
0:4.0.2-11.el9_7
fixed
Common Weakness Enumeration
References
https://github.com/capstone-engine/capstone/commit/cbef767ab33b82166d263895f24084b75b316df3
https://github.com/capstone-engine/capstone/security/advisories/GHSA-hj6g-v545-v7jg
https://github.com/capstone-engine/capstone/security/advisories/GHSA-hj6g-v545-v7jg