capstone vulnerabilities

3 known vulnerabilities in capstone from Capstone-engine. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.3 High severity

  capstone: Heap-based Buffer Overflow

  CVE-2026-55893Aug 20, 2026Capstone-engine

  Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call set_reg() and set_reg_n() using sh_info.op.op_count without checking the fixed-size operand

• 9.8 Critical severity

  capstone: Buffer Copy without Checking Size of Input

  CVE-2025-68114Dec 17, 2025Capstone-engine

  Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the

• 7.8 High severity

  capstone: Heap-based Buffer Overflow

  CVE-2025-67873Dec 17, 2025Capstone-engine

  Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow