Capstone-engine vulnerabilities
We track 3 vulnerabilities in Capstone-engine products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 20, 2026.
Latest Capstone-engine vulnerabilities
- 7.3 High severity
capstone: Heap-based Buffer Overflow
Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call set_reg() and set_reg_n() using sh_info.op.op_count without checking the fixed-size operand
- 9.8 Critical severity
capstone: Buffer Copy without Checking Size of Input
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the
- 7.8 High severity
capstone: Heap-based Buffer Overflow
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow