Skip to content
OpenAdvisories
Medium RHSA-2026:5224 2 CVEs

Red Hat Security Advisory: capstone security update

Published Mar 23, 2026 · Updated Aug 22, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 capstone 0:5.0.1-7.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 capstone-debuginfo 0:5.0.1-7.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 capstone-debugsource 0:5.0.1-7.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 capstone-devel 0:5.0.1-7.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 capstone-java 0:5.0.1-7.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3-capstone 0:5.0.1-7.el10_0

Vulnerabilities 2

  • Medium 4.8
    CVE-2025-67873

    Capstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflow

    Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow…

    capstone-engine capstone rust capstone Debian Ubuntu Azure Linux Alpine
  • Medium 4.8
    CVE-2025-68114

    Capstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflow

    Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when th…

    capstone-engine capstone rust capstone Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2423416
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2423419
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5224.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-67873
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-67873
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-67873
  • article
    https://github.com/capstone-engine/capstone/commit/cbef767ab33b82166d263895f24084b75b316df3
  • article
    https://github.com/capstone-engine/capstone/security/advisories/GHSA-hj6g-v545-v7jg
  • report
    https://access.redhat.com/security/cve/CVE-2025-68114
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-68114
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-68114
  • article
    https://github.com/capstone-engine/capstone/commit/2c7797182a1618be12017d7d41e0b6581d5d529e
  • article
    https://github.com/capstone-engine/capstone/security/advisories/GHSA-85f5-6xr3-q76r