CVE-2025-67873: 
NixOS vulnerability analysis and mitigation

CVE-2025-67873 is a heap-based buffer overflow vulnerability in the Capstone disassembly framework affecting versions 6.0.0-Alpha5 and all prior releases. The flaw arises because the skipdata length returned by a user-provided callback is not bounds-checked before being used in a memcpy into the fixed 24-byte cs_insn.bytes array, enabling heap memory corruption. It was disclosed on December 17, 2025, by GitHub user Finder16 via a GitHub Security Advisory (GitHub Advisory). The CVSS v3.1 base score is 7.8 (High) per NVD, while the GitHub advisory rates it 4.8 (Moderate) (GitHub Advisory, Microsoft MSRC).

The root cause is a missing bounds check (CWE-122: Heap-based Buffer Overflow) in the skipdata fallback path of cs.c. Specifically, cs_disasm (lines 1326–1339) and cs_disasm_iter (lines 1537–1549) both call memcpy(insn_cache->bytes, buffer, skipdata_bytes) without capping skipdata_bytes to sizeof(insn_cache->bytes) (24 bytes). Since the cs_opt_skipdata.callback API explicitly allows user-defined callbacks, any embedding that exposes this option to untrusted input is vulnerable. An attacker-controlled callback returning a value greater than 24 (e.g., 1024) causes the memcpy to write past the heap allocation for the cs_insn array. A public PoC using an invalid WASM opcode (0x06) to force the skipdata path and a callback returning 1024 was included in the advisory and confirmed with AddressSanitizer (GitHub Advisory, Fix Commit).

Successful exploitation can result in heap memory corruption, potentially leading to arbitrary code execution, information disclosure, or denial of service within the process embedding Capstone. The attack surface covers any application that uses Capstone with skipdata enabled and allows user-controlled or plugin-supplied skipdata callbacks, spanning all supported architectures. Because Capstone is widely embedded in security tools, debuggers, and reverse engineering frameworks, exploitation could affect the integrity and availability of those host applications (GitHub Advisory).

A public proof-of-concept exploit is available in the GitHub Security Advisory and was incorporated into the project's integration test suite after the fix (GitHub Advisory, Fix Commit). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. Exploitation requires local access, low privileges, and user interaction to trigger the malicious disassembly operation.

1. Identify a vulnerable target: Locate an application embedding Capstone versions ≤ 6.0.0-Alpha5 that exposes the CS_OPT_SKIPDATA_SETUP option to user-controlled or plugin-supplied callbacks.
2. Craft a malicious skipdata callback: Write a callback function that returns a value greater than 24 (e.g., 1024), which exceeds the size of cs_insn.bytes.
3. Configure Capstone with the malicious callback: Call cs_option(handle, CS_OPT_SKIPDATA, CS_OPT_ON) and cs_option(handle, CS_OPT_SKIPDATA_SETUP, (size_t)&skip) with the crafted cs_opt_skipdata struct referencing the oversized callback.
4. Trigger the skipdata path: Supply a binary buffer containing an invalid opcode for the target architecture (e.g., 0x06 for WASM) to force Capstone into the skipdata fallback path.
5. Trigger the overflow: Call cs_disasm() or cs_disasm_iter() on the crafted buffer; the unguarded memcpy(insn_cache->bytes, buffer, skipdata_bytes) writes beyond the 24-byte heap allocation, corrupting adjacent heap memory.
6. Achieve objective: Depending on heap layout and application context, the corruption may lead to a crash (DoS), information disclosure, or controlled code execution within the host process (GitHub Advisory).

• Process Behavior: Unexpected crashes or segmentation faults in applications embedding Capstone, particularly when processing untrusted binary input with skipdata enabled.
• Memory Sanitizer Output: AddressSanitizer (ASan) reports of heap-buffer-overflow in cs_disasm or cs_disasm_iter at the memcpy into cs_insn.bytes.
• Logs: Application crash logs or core dumps referencing Capstone library functions (cs_disasm, cs_disasm_iter) with abnormal memory access patterns.
• File System: Presence of PoC source files (e.g., poc_overflow.c) or test binaries referencing the big_skip callback pattern on developer or build systems (GitHub Advisory).

The fix is available in commit cbef767ab33b82166d263895f24084b75b316df3, which caps the memcpy length using MIN(skipdata_bytes, sizeof(insn_cache->bytes)) in both cs_disasm and cs_disasm_iter. Users should upgrade Capstone to version 6.0.0 (stable release) or any build incorporating this commit (Fix Commit). As a temporary workaround until patching is possible, restrict or disable the use of custom skipdata callbacks and validate all input to disassembler functions. Linux distribution packages (SUSE, Red Hat, Debian, Amazon Linux) have issued updated packages addressing this vulnerability (Microsoft MSRC).

The vulnerability was reported by GitHub user Finder16 and acknowledged by the Capstone maintainer Rot127, who merged the fix promptly (Fix Commit). Multiple Linux distributions including SUSE, Red Hat, Debian, and Amazon Linux issued security advisories and updated packages. A blog post titled "Securing Disassembly Engines: Critical" discussed the vulnerability in the context of disassembly framework security (Linux Security Blog).