Capstone Engine CVE-2025-67873

Exploitation requires the host application embedding capstone to explicitly enable the skip-data feature (CS_OPT_SKIPDATA on) AND register a custom skipdata setup callback that returns a skip length greater than the 24-byte cs_insn.bytes buffer; the attacker must then supply input containing bytes that fail to decode (e.g. an invalid WASM opcode) so disassembly enters the skipdata path and performs the oversized memcpy. Limiting factors: this is a non-default configuration (skipdata with a large-returning callback is not enabled by default), exploitation is local (AV:L) via attacker-controlled input that a victim must choose to disassemble (UI:R), and no authentication is involved. Applications using capstone with default options or a bounded skip length are not affected.

Signals are mixed and point to a LOW real-world priority despite a 7.8 'High' CVSS. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a local heap overflow (CWE-122) with full C/I/A impact but requiring user interaction - consistent with a victim disassembling an attacker-supplied binary. A proof-of-concept exists (publicly available exploit code exists, present as tests/integration/test_poc.c in the fix commit), which raises confidence the bug is genuine. However, EPSS is only 0.01% (3rd percentile) and there is no CISA KEV listing, indicating no observed widespread exploitation - classify as 'publicly available exploit code exists', NOT active exploitation. Crucially, the PoC and source diff show exploitation is NOT reachable in default configurations: it requires the host application to enable CS_OPT_SKIPDATA with a custom skipdata callback that returns a skip length larger than cs_insn.bytes (24 bytes). This conditionality is not reflected in the CVSS PR:N/AC:L metrics, so the raw score overstates realistic risk. Net: a legitimate memory-safety bug in a popular library, but low urgency outside applications that specifically use capstone's skipdata feature with a large-return callback.

An attacker crafts a malicious binary/blob and convinces a victim (or an automated analysis pipeline) to disassemble it with a capstone-based tool that has the skipdata option enabled and a callback returning more than 24 bytes. When capstone hits undecodable bytes it enters the skipdata path and memcpy's the oversized skip length into the fixed 24-byte cs_insn.bytes buffer, overflowing the heap. A working PoC (test_poc.c, using CS_ARCH_WASM and a 1024-byte skip callback) is published in the fix commit, demonstrating the overflow in both cs_disasm and cs_disasm_iter.