Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.
CVSS Details
- CVSS 3.1 Base Score: 4.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-capstoneUpgrade capstoneUpgrade capstone-javaUpgrade capstone-devel | Mar 23, 2026 | Mar 18, 2026 |
| Alpine Linux | — | Upgrade capstone | Feb 11, 2026 | Dec 17, 2025 |
| Amazon Linux Ami 2 | — | Upgrade python2-capstoneUpgrade capstone-debuginfoUpgrade capstoneUpgrade capstone-develUpgrade capstone-java | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-capstoneUpgrade capstone-debugsourceUpgrade python3-capstone-debuginfoUpgrade capstone-debuginfoUpgrade capstone-javaUpgrade capstone-develUpgrade capstone | Feb 10, 2026 | Dec 17, 2025 |
| Debian | — | Upgrade capstone | Jul 23, 2026 | Jul 23, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Jun 2, 2026 |
| Oracle_linux | — | Upgrade capstone-develUpgrade capstoneUpgrade capstone-javaUpgrade python3-capstone | Mar 20, 2026 | Dec 17, 2025 |
| Redhat_linux | — | Upgrade python3-capstone-debuginfoUpgrade capstone-develUpgrade capstone-debugsourceUpgrade capstoneUpgrade python3-capstoneUpgrade capstone-debuginfoUpgrade capstone-java | Mar 19, 2026 | Dec 17, 2025 |
| Rocky_linux | — | Upgrade capstone-debuginfoUpgrade capstoneUpgrade capstone-develUpgrade python3-capstoneUpgrade capstone-debugsourceUpgrade python3-capstone-debuginfo | Mar 31, 2026 | Mar 26, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub