{"id":"CVE-2025-68114","summary":"Capstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflow","details":"Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs. Commit 2c7797182a1618be12017d7d41e0b6581d5d529e fixes the issue.","aliases":["GHSA-85f5-6xr3-q76r"],"modified":"2026-08-12T15:14:48.753282Z","published":"2025-12-17T21:14:31.226Z","related":["ALSA-2026:39309","ALSA-2026:4898","ALSA-2026:6817","SUSE-SU-2026:0060-1","SUSE-SU-2026:20054-1","SUSE-SU-2026:20868-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-120","CWE-124"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68114.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68114.json"},{"type":"ADVISORY","url":"https://github.com/capstone-engine/capstone/security/advisories/GHSA-85f5-6xr3-q76r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68114"},{"type":"FIX","url":"https://github.com/capstone-engine/capstone/commit/2c7797182a1618be12017d7d41e0b6581d5d529e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/capstone-engine/capstone","events":[{"introduced":"97db712c91e964718f9cc300e81b9cf76b31a22e"},{"fixed":"2c7797182a1618be12017d7d41e0b6581d5d529e"}],"database_specific":{"extracted_events":[{"introduced":"6.0.0-alpha1"},{"last_affected":"6.0.0-alpha1"},{"introduced":"6.0.0-alpha2"},{"last_affected":"6.0.0-alpha2"},{"introduced":"6.0.0-alpha3"},{"last_affected":"6.0.0-alpha3"},{"introduced":"6.0.0-alpha4"},{"last_affected":"6.0.0-alpha4"},{"introduced":"6.0.0-alpha5"},{"last_affected":"6.0.0-alpha5"}],"source":["CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha1:*:*:*:*:*:*","cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha2:*:*:*:*:*:*","cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha3:*:*:*:*:*:*","cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha4:*:*:*:*:*:*","cpe:2.3:a:capstone-engine:capstone:6.0.0:alpha5:*:*:*:*:*:*"]}}],"versions":["6.0.0-alpha1","6.0.0-alpha2","6.0.0-alpha3","6.0.0-alpha4","6.0.0-alpha5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68114.json","vanir_signatures_modified":"2026-08-12T15:14:48Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/2c7797182a1618be12017d7d41e0b6581d5d529e","target":{"file":"tests/unit/include/unit_test.h"},"deprecated":false,"digest":{"line_hashes":["38183512480943367621915465734839263480","179056925853330904306037807417288304673","156955737411414667375753507208202176786","35542490554786979523313654169079774015"],"threshold":0.9},"id":"CVE-2025-68114-4a039f54"},{"deprecated":false,"digest":{"line_hashes":["104799443181680666571220090827433126101","145749487541825035222504241676669124560","272480164307369866905527421015921909006","232719784416819949372085967004347915752"],"threshold":0.9},"id":"CVE-2025-68114-5b6fd1e1","signature_type":"Line","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/2c7797182a1618be12017d7d41e0b6581d5d529e","target":{"file":"SStream.h"}},{"signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/2c7797182a1618be12017d7d41e0b6581d5d529e","target":{"file":"tests/unit/sstream.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["26580799822513680810900071855432266443","272491423694404427872882383680314605773","122546753726241026889451074095444852957","7451917664364825780596204956858144685","193528195158813550690072624422728662671","23233932794032932727549210811757876274","278501653130094257636890085876297442158"]},"id":"CVE-2025-68114-b6529f60","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"200822371892265313599121659825426363866","length":568},"id":"CVE-2025-68114-c0484747","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/2c7797182a1618be12017d7d41e0b6581d5d529e","target":{"file":"SStream.c","function":"SStream_concat"}},{"target":{"file":"tests/unit/sstream.c","function":"main"},"deprecated":false,"digest":{"function_hash":"276332624018350905365492612971771323355","length":537},"id":"CVE-2025-68114-c72022e8","signature_type":"Function","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/2c7797182a1618be12017d7d41e0b6581d5d529e"},{"digest":{"line_hashes":["186233073925322802491837053965931420149","332968745551372891548853607419313225041","208872343785869807590490152485531481876","112234655490822411310640889670600863614"],"threshold":0.9},"id":"CVE-2025-68114-f8076c96","signature_type":"Line","signature_version":"v1","source":"https://github.com/capstone-engine/capstone/commit/2c7797182a1618be12017d7d41e0b6581d5d529e","target":{"file":"SStream.c"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"}]}