{"id":"CVE-2025-67873","summary":"Capstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflow","details":"Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.","aliases":["GHSA-hj6g-v545-v7jg"],"modified":"2026-08-12T15:14:48.502151Z","published":"2025-12-17T21:12:13.739Z","related":["ALSA-2026:4898","ALSA-2026:6817","SUSE-SU-2026:0060-1","SUSE-SU-2026:20054-1","SUSE-SU-2026:20868-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-122"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67873.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67873.json"},{"type":"ADVISORY","url":"https://github.com/capstone-engine/capstone/security/advisories/GHSA-hj6g-v545-v7jg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67873"},{"type":"FIX","url":"https://github.com/capstone-engine/capstone/commit/cbef767ab33b82166d263895f24084b75b316df3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/capstone-engine/capstone","events":[{"introduced":"97db712c91e964718f9cc300e81b9cf76b31a22e"},{"fixed":"cbef767ab33b82166d263895f24084b75b316df3"}],"database_specific":{"source":["CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha1:*:*:*:*:*:*","cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha2:*:*:*:*:*:*","cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha3:*:*:*:*:*:*","cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha4:*:*:*:*:*:*","cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha5:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.0.0-alpha1"},{"last_affected":"6.0.0-alpha1"},{"introduced":"6.0.0-alpha2"},{"last_affected":"6.0.0-alpha2"},{"introduced":"6.0.0-alpha3"},{"last_affected":"6.0.0-alpha3"},{"introduced":"6.0.0-alpha4"},{"last_affected":"6.0.0-alpha4"},{"introduced":"6.0.0-alpha5"},{"last_affected":"6.0.0-alpha5"}]}}],"versions":["6.0.0-alpha1","6.0.0-alpha2","6.0.0-alpha3","6.0.0-alpha4","6.0.0-alpha5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67873.json","vanir_signatures_modified":"2026-08-12T15:14:48Z","vanir_signatures":[{"id":"CVE-2025-67873-2eded533","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/cbef767ab33b82166d263895f24084b75b316df3","target":{"file":"cs.c","function":"cs_disasm"},"deprecated":false,"digest":{"function_hash":"120005249773690817372286961807651630702","length":3407}},{"deprecated":false,"digest":{"function_hash":"263381900339651386714808960783944626214","length":1818},"id":"CVE-2025-67873-96f8ca92","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/cbef767ab33b82166d263895f24084b75b316df3","target":{"file":"cs.c","function":"cs_disasm_iter"}},{"deprecated":false,"digest":{"line_hashes":["198397741915101271876594429176715452249","178551590831113392981046669095220902750","173369944453292519982397756480620497589","130774544364814767540065253992691508408","83649265652012454627825268866918203832","166369049223699923858402334757367988201","85209596397956414303677933237032917515","310618838814994697821394253126533564489","301759177527286800628400263923429828933","182645681468710089829157874442623524633","103577790663696292516803741825323825972","170892149584398414070625942741937305060","55375405304008644731933288301457859158","789502981615529285216621930512497802","168379687773373722681512146844363365551","204582700926311727137842521227673261376","250319065923885430497915467749286172685"],"threshold":0.9},"id":"CVE-2025-67873-a9551169","signature_type":"Line","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/cbef767ab33b82166d263895f24084b75b316df3","target":{"file":"cs.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"}]}