CVE-2025-67873

Katalog CVE

CVSS 7.8 · High EPSS 0,24%

Kerentanan Heap-based Buffer Overflow pada capstone-engine capstone. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.

Rincian

Terbit di NVD

17 Desember 2025

Terakhir diubah

13 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/capstone-engine/capstone/security/advisories/GHSA-hj6g-v545-v7jg exploit · advisory vendor
• https://github.com/capstone-engine/capstone/commit/cbef767ab33b82166d263895f24084b75b316df3 patch