CVE-2025-68114 is a medium severity (CVSS 4.8) stack buffer flaw in the Capstone disassembly framework, version 6.0.0-Alpha5 and earlier. An unchecked vsnprintf return value can move a string stream index out of range. Commit 2c77971 is the fix, and the advisory limits exposure to custom hooks.
What's affected
Capstone versions 6.0.0-Alpha5 and prior. The record and the GitHub advisory both name the fix as commit 2c7797182a1618be12017d7d41e0b6581d5d529e. I did not find a released version number for the fix in the pages I fetched, so check the project releases for a build that includes the commit.
The advisory rates the issue medium, 4.8, matching the record. It narrows the exposure: the bad return value comes from a custom vsnprintf function installed through the memory options. Only an embedding application that lets untrusted code install such a hook is exposed. A program that uses the default behavior is not on the described path.
How to check if you're exposed
Find where your software includes Capstone and which version:
pkg-config --modversion capstone
pip show capstone
Then search your code for use of the memory option API, since that is how a custom hook is installed:
grep -rn "CS_OPT_MEM\|cs_opt_mem" src include
If you never set that option, or only set it to trusted allocation functions, the described trigger does not apply to you. If you ship Capstone inside a product, check the vendored source for the fix commit.
What to do now
- List products and tools that bundle Capstone, including Python wheels and static builds.
- Move to a release that contains commit 2c77971 when the project publishes one, or cherry pick the commit in your vendored copy.
- Do not let untrusted plugins or scripts call the memory option API.
- Run disassembly of untrusted binaries in a sandboxed process with limited permissions.
- Add a test that rejects negative or oversized return values from custom hooks.
Why it matters
The weaknesses are CWE-120, a buffer operation without a size check, and CWE-124, buffer underwrite. The string stream adds the return value of vsnprintf directly to its index. A negative value moves the index before the buffer, and a very large value skips the overflow check, so the next write lands outside the buffer.
It is a good example of a low score that still teaches something. The trigger needs a hostile callback, so the practical risk is small for most users. Even so, library code should treat every return value from a callback as untrusted. A disassembler is often pointed at hostile binaries, so memory safety matters there. The record does not list this CVE as known exploited.
Quick check
Do ordinary Capstone users need to worry?
The advisory says the trigger needs a custom vsnprintf installed through the memory options. If you do not install one, the described path does not apply.
Is there a version number for the fix?
The pages I fetched give only a commit. Check the project releases.
Sources
Last reviewed: 18 October 2026.
