Skip to content
OpenAdvisories
Medium · 4.8 CVE-2025-68114 EUVD-2025-203995

Capstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflow

Published Dec 17, 2025 · Updated Dec 18, 2025 · Assigned by GitHub_M

Vendor: capstone-engine Product: capstone Package: capstone Package: capstone Package: capstone Package: capstone Package: rust Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs. Commit 2c7797182a1618be12017d7d41e0b6581d5d529e fixes the issue.

Affected products

VendorProductAffectedFixed
capstone-engine capstone <= 6.0.0-Alpha5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 capstone 5.0.7-1 —
Debian 13 capstone 5.0.7-1~deb13u1 —
Debian 12 capstone No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 capstone No fix yet —
Ubuntu 26.04 LTS capstone No fix yet —
Ubuntu 25.10 capstone No fix yet —
Ubuntu 24.04 LTS capstone No fix yet —
Ubuntu 22.04 LTS capstone No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS capstone No fix yet —
Ubuntu 18.04 LTS capstone No fix yet —
Ubuntu 16.04 LTS capstone No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 capstone +3 5.0.1-7.el10_1 RHSA-2026:6817
RHEL 9 capstone +3 4.0.2-11.el9_7 RHSA-2026:39309, RHSA-2026:4898
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS capstone +3 5.0.1-7.el10_0 RHSA-2026:5224
RHEL 9.6 EUS capstone +3 4.0.2-11.el9_6 RHSA-2026:5124
RHEL 9.4 EUS capstone +3 4.0.2-11.el9_4 RHSA-2026:5125
RHEL 9.2 E4S capstone 4.0.2-11.el9_2 RHSA-2026:5123
RHEL 9.0 E4S capstone 4.0.2-5.el9_0 RHSA-2026:13923
Red Hat Hardened Images 1 capstone +4 5.0.7-0.1.hum1 RHSA-2026:12781

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 capstone-java +1 5.0.1-7.el10_1 ALSA-2026:6817
AlmaLinux 9 capstone +3 4.0.2-11.el9_7 ALSA-2026:39309, ALSA-2026:4898

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 capstone 5.0.1-7.el10_1 RLSA-2026:6817
Rocky Linux 9 capstone 4.0.2-11.el9_7 RLSA-2026:39309, RLSA-2026:4898

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 capstone 4.0.2-150500.3.3.1 SUSE-SU-2026:0060-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.1 capstone 4.0.2-slfo.1.1_2.1 SUSE-SU-2026:20054-1
SLE Micro 6.0 capstone 4.0.2-6.1 SUSE-SU-2026:20868-1
SLE Micro 5.5 capstone 4.0.2-150500.3.3.1 SUSE-SU-2026:0060-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.6 capstone 4.0.2-150500.3.3.1 SUSE-SU-2026:0060-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 capstone 5.0.7-r0 —
Alpine v3.23 capstone 5.0.7-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 capstone +3 4.0.2-9.amzn2023.0.5 ALAS2023-2026-1772
Amazon Linux 2 capstone +3 3.0.5-1.amzn2.0.2 ALAS2-2026-3351

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 capstone No fix yet —
Azure Linux 3 rust 1.90.0-4 —
Azure Linux 2 (CBL-Mariner) capstone No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 capstone +3 5.0.1-7.el10_1 ELSA-2026-6817
Oracle Linux 9 capstone +3 4.0.2-11.el9_7 ELSA-2026-4898

Advisories 23

References