CVE-2025-67873 Capstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflow
A heap buffer overflow in Capstone allows attackers to execute arbitrary code or cause denial of service via crafted disassembly input.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-67873?
CVE-2025-67873 is a medium-severity memory corruption vulnerability in capstone-engine capstone, published on 17 Dec 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.
Weakness: CWE-122
Which versions are affected by CVE-2025-67873?
It affects 1 product.
Products include Capstone-Engine Capstone.
How do I fix CVE-2025-67873?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-67873 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-67873 exists.
Other vulnerabilities in capstone-engine capstone
Sources
Also known as AZL-72700, AZL-72818, AZL-74915, BELL-CVE-2025-67873, CLSA-2026-1774374355, CLSA-2026-1774437715 and 3 more.