Vulnerability · Published Dec 17, 2025 · Assigned by GitHub_M
CVE-2025-67873Capstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflow
Medium 4.8
In plain English
A medium-severity heap buffer overflow in capstone from capstone-engine. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | capstone | 4.0.2-11.el9_7 | ALSA-2026:4898 |
| AlmaLinux:9 | capstone-devel | 4.0.2-11.el9_7 | ALSA-2026:4898 |
| AlmaLinux:10 | capstone-java | 5.0.1-7.el10_1 | ALSA-2026:6817 |
| AlmaLinux:9 | capstone-java | 4.0.2-11.el9_7 | ALSA-2026:4898 |
| AlmaLinux:10 | python3-capstone | 5.0.1-7.el10_1 | ALSA-2026:6817 |
| AlmaLinux:9 | python3-capstone | 4.0.2-11.el9_7 | ALSA-2026:4898 |
| Alpine:v3.23 | capstone | 5.0.7-r0 | ALPINE-CVE-2025-67873 |
| Alpine:v3.24 | capstone | 5.0.7-r0 | ALPINE-CVE-2025-67873 |
| Debian:12 | capstone | no fix listed | DEBIAN-CVE-2025-67873 |
| Debian:13 | capstone | 5.0.7-1~deb13u1 | DEBIAN-CVE-2025-67873 |
| Debian:14 | capstone | 5.0.7-1 | DEBIAN-CVE-2025-67873 |
| Rocky Linux:10 | capstone | 0:5.0.1-7.el10_1 | RLSA-2026:6817 |
| Rocky Linux:9 | capstone | 0:4.0.2-11.el9_7 | RLSA-2026:4898 |
| Ubuntu:22.04:LTS | capstone | no fix listed | UBUNTU-CVE-2025-67873 |
| Ubuntu:24.04:LTS | capstone | no fix listed | UBUNTU-CVE-2025-67873 |
| Ubuntu:25.10 | capstone | no fix listed | UBUNTU-CVE-2025-67873 |
| Ubuntu:26.04:LTS | capstone | no fix listed | UBUNTU-CVE-2025-67873 |
| Ubuntu:26.10 | capstone | no fix listed | UBUNTU-CVE-2025-67873 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| capstone-engine | capstone | <= 6.0.0-Alpha5 |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L