CVE-2025-68114

Katalog CVE

CVSS 9.8 · Critical EPSS 0,20%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada capstone-engine capstone. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs. Commit 2c7797182a1618be12017d7d41e0b6581d5d529e fixes the issue.

Rincian

Terbit di NVD

17 Desember 2025

Terakhir diubah

13 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-124: Buffer Underwrite ('Buffer Underflow')

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/capstone-engine/capstone/security/advisories/GHSA-85f5-6xr3-q76r advisory vendor
• https://github.com/capstone-engine/capstone/commit/2c7797182a1618be12017d7d41e0b6581d5d529e patch