Vulnerability · Published Dec 17, 2025 · Assigned by GitHub_M
CVE-2025-68114Capstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflow
Medium 4.8
In plain English
A medium-severity buffer overflow in capstone from capstone-engine. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs. Commit 2c7797182a1618be12017d7d41e0b6581d5d529e fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | capstone | 4.0.2-13.el9_8 | ALSA-2026:39309 |
| AlmaLinux:9 | capstone | 4.0.2-11.el9_7 | ALSA-2026:4898 |
| AlmaLinux:9 | capstone-devel | 4.0.2-11.el9_7 | ALSA-2026:4898 |
| AlmaLinux:9 | capstone-devel | 4.0.2-13.el9_8 | ALSA-2026:39309 |
| AlmaLinux:10 | capstone-java | 5.0.1-7.el10_1 | ALSA-2026:6817 |
| AlmaLinux:9 | capstone-java | 4.0.2-11.el9_7 | ALSA-2026:4898 |
| AlmaLinux:9 | capstone-java | 4.0.2-13.el9_8 | ALSA-2026:39309 |
| AlmaLinux:10 | python3-capstone | 5.0.1-7.el10_1 | ALSA-2026:6817 |
| AlmaLinux:9 | python3-capstone | 4.0.2-11.el9_7 | ALSA-2026:4898 |
| AlmaLinux:9 | python3-capstone | 4.0.2-13.el9_8 | ALSA-2026:39309 |
| Alpine:v3.23 | capstone | 5.0.7-r0 | ALPINE-CVE-2025-68114 |
| Alpine:v3.24 | capstone | 5.0.7-r0 | ALPINE-CVE-2025-68114 |
| Debian:12 | capstone | no fix listed | DEBIAN-CVE-2025-68114 |
| Debian:13 | capstone | 5.0.7-1~deb13u1 | DEBIAN-CVE-2025-68114 |
| Debian:14 | capstone | 5.0.7-1 | DEBIAN-CVE-2025-68114 |
| Rocky Linux:10 | capstone | 0:5.0.1-7.el10_1 | RLSA-2026:6817 |
| Rocky Linux:9 | capstone | 0:4.0.2-11.el9_7 | RLSA-2026:4898 |
| Rocky Linux:9 | capstone | 0:4.0.2-13.el9_8 | RLSA-2026:39309 |
| Ubuntu:22.04:LTS | capstone | no fix listed | UBUNTU-CVE-2025-68114 |
| Ubuntu:24.04:LTS | capstone | no fix listed | UBUNTU-CVE-2025-68114 |
| Ubuntu:25.10 | capstone | no fix listed | UBUNTU-CVE-2025-68114 |
| Ubuntu:26.04:LTS | capstone | no fix listed | UBUNTU-CVE-2025-68114 |
| Ubuntu:26.10 | capstone | no fix listed | UBUNTU-CVE-2025-68114 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| capstone-engine | capstone | <= 6.0.0-Alpha5 |
Weakness: CWE-124, CWE-120 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L