CVE-2025-68114 Capstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflow
A malicious vsnprintf callback in Capstone can cause stack buffer underflow or overflow, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-68114?
CVE-2025-68114 is a medium-severity memory corruption vulnerability in capstone-engine capstone, published on 17 Dec 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs. Commit 2c7797182a1618be12017d7d41e0b6581d5d529e fixes the issue.
Which versions are affected by CVE-2025-68114?
It affects 1 product.
Linux distribution packages (15)
capstone AlmaLinux:9 | All versions | 4.0.2-13.el9_8 |
capstone-devel AlmaLinux:9 | All versions | 4.0.2-13.el9_8 |
capstone-java AlmaLinux:9 | All versions | 4.0.2-13.el9_8 |
python3-capstone AlmaLinux:9 | All versions | 4.0.2-13.el9_8 |
capstone Red Hat:enterprise_linux:9::appstream | All versions | 0:4.0.2-13.el9_8 |
capstone-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:4.0.2-13.el9_8 |
capstone-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:4.0.2-13.el9_8 |
python3-capstone-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:4.0.2-13.el9_8 |
capstone-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:4.0.2-13.el9_8 |
capstone-debugsource Red Hat:enterprise_linux:9::crb | All versions | 0:4.0.2-13.el9_8 |
capstone-devel Red Hat:enterprise_linux:9::crb | All versions | 0:4.0.2-13.el9_8 |
capstone-java Red Hat:enterprise_linux:9::crb | All versions | 0:4.0.2-13.el9_8 |
python3-capstone Red Hat:enterprise_linux:9::crb | All versions | 0:4.0.2-13.el9_8 |
python3-capstone-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:4.0.2-13.el9_8 |
capstone Rocky Linux:9 | All versions | 0:4.0.2-13.el9_8 |
Products include Capstone-Engine Capstone.
How do I fix CVE-2025-68114?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-68114 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68114 exists.
Other vulnerabilities in capstone-engine capstone
Sources
Also known as ALSA-2026:39309, AZL-72697, AZL-72821, AZL-74805, BELL-CVE-2025-68114, CLSA-2026-1774347657 and 6 more.