Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs. Commit 2c7797182a1618be12017d7d41e0b6581d5d529e fixes the issue.
CVSS Details
- CVSS 3.1 Base Score: 4.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade capstone-develUpgrade capstoneUpgrade python3-capstoneUpgrade capstone-java | Mar 23, 2026 | Mar 18, 2026 |
| Alpine Linux | — | Upgrade capstone | Feb 11, 2026 | Dec 17, 2025 |
| Amazon Linux Ami 2 | — | Upgrade python2-capstoneUpgrade capstone-debuginfoUpgrade capstone-javaUpgrade capstoneUpgrade capstone-devel | Jun 9, 2026 | Jun 9, 2026 |
| Amazon_linux_2023 | — | Upgrade capstone-javaUpgrade capstone-debuginfoUpgrade python3-capstoneUpgrade python3-capstone-debuginfoUpgrade capstone-develUpgrade capstone-debugsourceUpgrade capstone | Jun 9, 2026 | Dec 17, 2025 |
| Debian | — | Upgrade capstone | Jul 23, 2026 | Jul 23, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Jun 2, 2026 |
| Oracle_linux | — | Upgrade python3-capstoneUpgrade capstone-javaUpgrade capstone-develUpgrade capstone | Mar 20, 2026 | Dec 17, 2025 |
| Redhat_linux | — | Upgrade capstone-develUpgrade capstone-javaUpgrade capstoneUpgrade python3-capstoneUpgrade python3-capstone-debuginfoUpgrade capstone-debuginfoUpgrade capstone-debugsource | Mar 19, 2026 | Dec 17, 2025 |
| Rocky_linux | — | Upgrade capstone-develUpgrade python3-capstoneUpgrade capstoneUpgrade python3-capstone-debuginfoUpgrade capstone-debugsourceUpgrade capstone-debuginfo | Mar 31, 2026 | Mar 26, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub