Capstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflow
Priority HIGH 67CWE-122Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.
Summary
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00233 14th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 8 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| capstone-engine | capstone | up to 6.0.0-Alpha5 | — | No fix listed | CNA |
- capstone Vendorcapstone-engine Affected up to 6.0.0-Alpha5 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:capstone-engine:capstone:*:*:*:*:*:*:*:* | before 6.0.0 | Vulnerable | capstone-engine |
| cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha1:*:*:*:*:*:* | 6.0.0 alpha1 | Vulnerable | capstone-engine |
| cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha2:*:*:*:*:*:* | 6.0.0 alpha2 | Vulnerable | capstone-engine |
| cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha3:*:*:*:*:*:* | 6.0.0 alpha3 | Vulnerable | capstone-engine |
| cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha4:*:*:*:*:*:* | 6.0.0 alpha4 | Vulnerable | capstone-engine |
| cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha5:*:*:*:*:*:* | 6.0.0 alpha5 | Vulnerable | capstone-engine |
- cpe:2.3:a:capstone-engine:capstone:*:*:*:*:*:*:*:* Versions before 6.0.0 Vulnerable ·capstone-engine
- cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha1:*:*:*:*:*:* Versions 6.0.0 alpha1 Vulnerable ·capstone-engine
- cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha2:*:*:*:*:*:* Versions 6.0.0 alpha2 Vulnerable ·capstone-engine
- cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha3:*:*:*:*:*:* Versions 6.0.0 alpha3 Vulnerable ·capstone-engine
- cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha4:*:*:*:*:*:* Versions 6.0.0 alpha4 Vulnerable ·capstone-engine
- cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha5:*:*:*:*:*:* Versions 6.0.0 alpha5 Vulnerable ·capstone-engine
Remediation
Red Hat 8 advisories
- RHSA-2026:13923 Released 2026-05-06 · Red Hat rating Moderatecapstone security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) capstone-4.0.2-5.el9_0
- RHSA-2026:12781 Released 2026-05-01 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images capstone-5.0.7-0.1.hum1@aarch64, capstone-5.0.7-0.1.hum1@src, capstone-5.0.7-0.1.hum1@x86_64 +8
- RHSA-2026:6817 Released 2026-04-07 · Red Hat rating Importantcapstone security update
- Red Hat Enterprise Linux AppStream (v. 10) capstone-5.0.1-7.el10_1
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) capstone-devel-5.0.1-7.el10_1, capstone-java-5.0.1-7.el10_1, python3-capstone-5.0.1-7.el10_1
Show 5 more Red Hat advisories
- RHSA-2026:5224 Released 2026-03-23 · Red Hat rating Moderatecapstone security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) capstone-5.0.1-7.el10_0
- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) capstone-devel-5.0.1-7.el10_0, capstone-java-5.0.1-7.el10_0, python3-capstone-5.0.1-7.el10_0
- RHSA-2026:5124 Released 2026-03-19 · Red Hat rating Moderatecapstone security update
- Red Hat CodeReady Linux Builder EUS (v.9.6) capstone-devel-4.0.2-11.el9_6, capstone-java-4.0.2-11.el9_6, python3-capstone-4.0.2-11.el9_6
- Red Hat Enterprise Linux AppStream EUS (v.9.6) capstone-4.0.2-11.el9_6
- RHSA-2026:5123 Released 2026-03-19 · Red Hat rating Moderatecapstone security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) capstone-4.0.2-11.el9_2
- RHSA-2026:5125 Released 2026-03-19 · Red Hat rating Moderatecapstone security update
- Red Hat CodeReady Linux Builder EUS (v.9.4) capstone-devel-4.0.2-11.el9_4, capstone-java-4.0.2-11.el9_4, python3-capstone-4.0.2-11.el9_4
- Red Hat Enterprise Linux AppStream EUS (v.9.4) capstone-4.0.2-11.el9_4
- RHSA-2026:4898 Released 2026-03-18 · Red Hat rating Importantcapstone security update
- Red Hat Enterprise Linux AppStream (v. 9) capstone-4.0.2-11.el9_7
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) capstone-devel-4.0.2-11.el9_7, capstone-java-4.0.2-11.el9_7, python3-capstone-4.0.2-11.el9_7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat CodeReady Linux Builder EUS (v.9.4) | Fixed | RHSA-2026:5125 |
| Red Hat CodeReady Linux Builder EUS (v.9.6) | Fixed | RHSA-2026:5124 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:6817 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:4898 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2026:13923 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:5123 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:5224 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2026:5125 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:5124 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2026:6817 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | Fixed | RHSA-2026:4898 |
| Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | Fixed | RHSA-2026:5224 |
| Red Hat Hardened Images | Fixed | RHSA-2026:12781 |
Not affected: 4 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2025-67873
References
More capstone-engine Capstone vulnerabilities
- TI-2025-41703 Capstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflow CVSS 3.1CRITICAL 9.8
- TI-2026-34733 Capstone has a NULL Pointer Dereference with 3DNow! opcodes CVSS 3.1MEDIUM 5.9
- TI-2017-04662 Integer overflow in the cs_winkernel_malloc function in winkernel_mm.c in Capstone 3.0.4… CVSS 3.0HIGH 8.8
- TI-2016-06150 Capstone 3.0.4 has an out-of-bounds vulnerability (SEGV caused by a read memory access)… CVSS 3.0MEDIUM 5.5
Sources
- CVE-2025-67873 · CVE Program
- CVE-2025-67873 · NVD
- FIRST EPSS
- CVE-2025-67873 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences