Capstone CVE-2025-68114

Exploitation requires reaching Capstone's SStream formatting path (SStream_concat) with the internal vsnprintf returning a negative value, which underflows the signed SStream.index and triggers out-of-bounds access on the next write. The demonstrated trigger depends on attacker control of Capstone's memory callbacks via cs_option(CS_OPT_MEM) to install a failing vsnprintf - a non-default configuration. Limiting factors: under default configuration vsnprintf virtually never returns negative, so the practical attack surface is narrow and largely confined to integrations that disassemble untrusted input and encounter a genuine formatting error, or that expose the custom-allocator API to untrusted control. Affected versions are capstone through the fix and the 6.0.0 alpha1-alpha5 pre-releases; fixed in Alpine 5.0.7-r0 and upstream.

The input CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) paints this as a critical, trivially-exploitable remote code execution flaw, but the corroborating signals strongly contradict that severity. EPSS is only 0.04% (12th percentile), there is no CISA KEV listing, and no independent exploit has surfaced. More importantly, the source-code evidence shows the actual root cause: an underflow of the signed SStream.index field (fixed by changing it to size_t and adding a return/overflow check when vsnprintf returns a negative value). The provided proof-of-concept test can only trigger the underflow by injecting a malicious vsnprintf via Capstone's CS_OPT_MEM custom-allocator callback (evil_vsnprintf returns -1). In normal deployments vsnprintf effectively never returns negative, so the AC:L rating in the input is questionable - reaching the underflow is NOT low-complexity under default configuration. This is best characterized as a genuine memory-safety defect with a high theoretical impact but low real-world exploitation probability: a high-CVSS-but-low-real-risk issue for most consumers, worth patching on normal maintenance cycles rather than emergency escalation. CONFLICT TO NOTE: CVSS claims AV:N/AC:L, yet the only demonstrated trigger requires attacker control over Capstone's memory/vsnprintf callback or an environment where vsnprintf legitimately fails - verify the realistic trigger path against your integration.

An application links Capstone to disassemble attacker-supplied binary data; if a code path causes the internal vsnprintf to return a negative value (error), SStream.index underflows and a subsequent SStream_concat1 writes before the buffer, enabling out-of-bounds read/write that could corrupt memory or crash the process. The commit ships a demonstrating unit test (test_underflow_in_sstream) that forces the condition via a custom vsnprintf memory callback, but no weaponized public exploit exists; practical exploitation against a default configuration requires a realistic way to make vsnprintf fail, which is uncommon.