Critical Memory Corruption and Buffer Overflow Vulnerabilities in Capstone Disassembly Framework
Summary
RLSA-2026:6817: Important: capstone security update. Affects capstone versions < 0:5.0.1-7.el10_1. Fixed in 0:5.0.1-7.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Capstone is a widely used disassembly framework designed for binary analysis and reverse engineering within the security community. It provides a powerful and flexible API for disassembling machine code into human-readable assembly instructions, making it an essential tool for security researchers and developers. However, recent vulnerabilities have been identified that could compromise the integrity and security of applications utilizing this framework.
Vulnerability Detail
The vulnerabilities in Capstone stem from two critical issues: first, a memory corruption vulnerability caused by unchecked return values from the vsnprintf function (CVE-2025-68114), which can lead to unpredictable behavior and potential data corruption. Second, a heap buffer overflow vulnerability in the skipdata callback (CVE-2025-67873) allows an attacker to exploit the framework, leading to denial of service or arbitrary code execution. These vulnerabilities can be exploited by malicious actors to execute arbitrary code or crash applications that rely on Capstone for disassembly.
How To Fix
Minimum fixed version
0:5.0.1-7.el10_1
This is the first release that contains the fix.
sudo dnf update capstoneTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of the affected features in Capstone until the package is updated. It is advisable to avoid using the skipdata callback functionality until the patch is applied.
Conclusion
In summary, the Capstone disassembly framework has critical vulnerabilities that could lead to severe security risks if not addressed. Users are strongly encouraged to update to the latest patched version to ensure their applications remain secure. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for capstone →
FAQ
Capstone is a disassembly framework that converts machine code into human-readable assembly instructions, widely used for binary analysis and reverse engineering.
The main vulnerabilities include a memory corruption issue due to unchecked vsnprintf return values and a heap buffer overflow in the skipdata callback.
Exploitation of these vulnerabilities can lead to denial of service or arbitrary code execution, potentially compromising the security of your application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground without needing to sign up.
The CVSS score for these vulnerabilities is 7.3, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for capstone.
