Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.
CVSS Details
- CVSS 3.1 Base Score: 4.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade capstoneUpgrade capstone-develUpgrade capstone-javaUpgrade python3-capstone | Mar 23, 2026 | Mar 18, 2026 |
| Alpine Linux | — | Upgrade capstone | Feb 11, 2026 | Dec 17, 2025 |
| Amazon Linux Ami 2 | — | Upgrade capstone-debuginfoUpgrade python2-capstoneUpgrade capstone-develUpgrade capstoneUpgrade capstone-java | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-capstone-debuginfoUpgrade capstone-debugsourceUpgrade capstone-debuginfoUpgrade python3-capstoneUpgrade capstoneUpgrade capstone-develUpgrade capstone-java | Feb 10, 2026 | Dec 17, 2025 |
| Debian | — | Upgrade capstone | Jul 23, 2026 | Jul 23, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Jun 2, 2026 |
| Oracle_linux | — | Upgrade python3-capstoneUpgrade capstone-javaUpgrade capstoneUpgrade capstone-devel | Mar 20, 2026 | Dec 17, 2025 |
| Redhat_linux | — | Upgrade python3-capstoneUpgrade capstone-javaUpgrade capstone-debuginfoUpgrade capstoneUpgrade capstone-debugsourceUpgrade capstone-develUpgrade python3-capstone-debuginfo | Mar 19, 2026 | Dec 17, 2025 |
| Rocky_linux | — | Upgrade python3-capstoneUpgrade capstone-develUpgrade capstoneUpgrade capstone-debuginfoUpgrade capstone-debugsourceUpgrade python3-capstone-debuginfo | Mar 31, 2026 | Mar 26, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub