critical
CVE-2025-68114
capstone: Capstone: Memory corruption via unchecked vsnprintf return
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Photon OS. Rated lower by AlmaLinux (high), Oracle (high), Rocky Linux (high), Red Hat (medium), Amazon (medium), Azure Linux (medium).
Description
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs. Commit 2c7797182a1618be12017d7d41e0b6581d5d529e fixes the issue.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 4.0 | capstone, capstone-devel | 4.0.2-2.ph4 |
| Photon OS 5.0 | capstone, capstone-devel | 4.0.2-3.ph5 |
| alma 10 | capstone-java, python3-capstone | 5.0.1-7.el10_1 |
| alma 9 | capstone, capstone-devel, capstone-java and 1 more | 4.0.2-11.el9_7 |
| alpine 3.23 | capstone | 5.0.7-r0 |
| alpine 3.24 | capstone | 5.0.7-r0 |
| alpine edge | capstone | 5.0.7-r0 |
| amazon linux 2 | capstone, capstone-debuginfo, capstone-devel and 2 more | 3.0.5-1.amzn2.0.2 |
| amazon linux 2023 | capstone, capstone-debuginfo, capstone-debugsource and 4 more | 4.0.2-9.amzn2023.0.5 |
| Azure Linux 3.0 | rust | 0:1.90.0-4.azl3 |
| debian 11 | capstone | no fix listed |
| debian 12 | capstone | no fix listed |
Show all 63 entries from 30 sources
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 4.0 | capstone | 4.0.2-2.ph4 |
| Photon OS 4.0 | capstone-devel | 4.0.2-2.ph4 |
| Photon OS 5.0 | capstone | 4.0.2-3.ph5 |
| Photon OS 5.0 | capstone-devel | 4.0.2-3.ph5 |
| alma 10 | capstone-java | 5.0.1-7.el10_1 |
| alma 10 | python3-capstone | 5.0.1-7.el10_1 |
| alma 9 | capstone | 4.0.2-11.el9_7 |
| alma 9 | capstone-devel | 4.0.2-11.el9_7 |
| alma 9 | capstone-java | 4.0.2-11.el9_7 |
| alma 9 | python3-capstone | 4.0.2-11.el9_7 |
| alpine 3.23 | capstone | 5.0.7-r0 |
| alpine 3.24 | capstone | 5.0.7-r0 |
| alpine edge | capstone | 5.0.7-r0 |
| amazon linux 2 | capstone | 3.0.5-1.amzn2.0.2 |
| amazon linux 2 | capstone-debuginfo | 3.0.5-1.amzn2.0.2 |
| amazon linux 2 | capstone-devel | 3.0.5-1.amzn2.0.2 |
| amazon linux 2 | capstone-java | 3.0.5-1.amzn2.0.2 |
| amazon linux 2 | python2-capstone | 3.0.5-1.amzn2.0.2 |
| amazon linux 2023 | capstone | 4.0.2-9.amzn2023.0.5 |
| amazon linux 2023 | capstone-debuginfo | 4.0.2-9.amzn2023.0.5 |
| amazon linux 2023 | capstone-debugsource | 4.0.2-9.amzn2023.0.5 |
| amazon linux 2023 | capstone-devel | 4.0.2-9.amzn2023.0.5 |
| amazon linux 2023 | capstone-java | 4.0.2-9.amzn2023.0.5 |
| amazon linux 2023 | python3-capstone | 4.0.2-9.amzn2023.0.5 |
| amazon linux 2023 | python3-capstone-debuginfo | 4.0.2-9.amzn2023.0.5 |
| Azure Linux 3.0 | rust | 0:1.90.0-4.azl3 |
| debian 11 | capstone | no fix listed |
| debian 12 | capstone | no fix listed |
| debian 13 | capstone | 5.0.7-1~deb13u1 |
| debian 14 | capstone | 5.0.7-1 |
| echo | capstone | 5.0.7-1~deb13u1 |
| Oracle Linux 9 | capstone | 4.0.2-11.el9_7 |
| Oracle Linux 9 | capstone-devel | 4.0.2-11.el9_7 |
| Oracle Linux 9 | capstone-java | 4.0.2-11.el9_7 |
| Oracle Linux 9 | python3-capstone | 4.0.2-11.el9_7 |
| rapidfort alma 9 | capstone | 4.0.2-13.el9_8 |
| rapidfort alpine 3.20 | capstone | 5.0.7-r0 |
| rapidfort alpine 3.21 | capstone | 5.0.7-r0 |
| rapidfort alpine 3.22 | capstone | 5.0.7-r0 |
| rapidfort alpine 3.23 | capstone | 5.0.7-r0 |
| rapidfort alpine 3.24 | capstone | 5.0.7-r0 |
| rapidfort amazon linux 2023 | capstone | 4.0.2-9.amzn2023.0.5 |
| rapidfort amazon linux 2023 | capstone-devel | 4.0.2-9.amzn2023.0.5 |
| rapidfort amazon linux 2023 | capstone-java | 4.0.2-9.amzn2023.0.5 |
| rapidfort amazon linux 2023 | python3-capstone | 4.0.2-9.amzn2023.0.5 |
| rapidfort debian 12 | capstone | 0:5.0.7-1, 0:5.0.7-1~deb13u1 |
| rapidfort debian 13 | capstone | 0:5.0.7-1, 0:5.0.7-1~deb13u1 |
| rapidfort fedora 43 | capstone | 5.0.5-8.fc43 |
| rapidfort fedora 43 | capstone-devel | 5.0.5-8.fc43 |
| rapidfort fedora 43 | capstone-java | 5.0.5-8.fc43 |
| rapidfort fedora 43 | capstone-static | 5.0.5-8.fc43 |
| rapidfort fedora 43 | python3-capstone | 5.0.5-8.fc43 |
| rapidfort Oracle Linux 10 | capstone | 0:5.0.1-7.el10_1 |
| rapidfort Oracle Linux 10 | capstone-devel | 0:5.0.1-7.el10_1 |
| rapidfort Oracle Linux 10 | capstone-java | 0:5.0.1-7.el10_1 |
| rapidfort Oracle Linux 10 | python3-capstone | 0:5.0.1-7.el10_1 |
| rapidfort Oracle Linux 9 | capstone | 0:4.0.2-11.el9_7 |
| rapidfort Oracle Linux 9 | capstone-devel | 0:4.0.2-11.el9_7 |
| rapidfort Oracle Linux 9 | capstone-java | 0:4.0.2-11.el9_7 |
| rapidfort Oracle Linux 9 | capstone-static | no fix listed |
| rapidfort Oracle Linux 9 | python3-capstone | 0:4.0.2-11.el9_7 |
| rocky 10 | capstone | 5.0.1-7.el10_1 |
| rocky 9 | capstone | 4.0.2-11.el9_7 |
References
- https://access.redhat.com/errata/RHSA-2026:4898
- https://access.redhat.com/security/cve/CVE-2025-68114
- https://bugzilla.redhat.com/2423416
- https://bugzilla.redhat.com/2423419
- https://bugzilla.redhat.com/show_bug.cgi?id=2423416
- https://bugzilla.redhat.com/show_bug.cgi?id=2423419
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67873
All 17 references
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68114
- https://errata.almalinux.org/9/ALSA-2026-4898.html
- https://errata.rockylinux.org/RLSA-2026:4898
- https://github.com/capstone-engine/capstone/commit/2c7797182a1618be12017d7d41e0b6581d5d529e
- https://github.com/capstone-engine/capstone/security/advisories/GHSA-85f5-6xr3-q76r
- https://linux.oracle.com/cve/CVE-2025-68114.html
- https://linux.oracle.com/errata/ELSA-2026-6817.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-68114
- https://www.cve.org/CVERecord?id=CVE-2025-68114