Red Hat Product Security released an advisory (RHSA-2026:13923) for two vulnerabilities in the Capstone disassembly framework included in Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. CVE-2025-68114 involves memory corruption due to an unchecked vsnprintf return, and CVE-2025-67873 involves a heap buffer overflow triggered via the skipdata callback, potentially allowing denial of service or arbitrary code execution. The advisory provides updated capstone packages (version 4.0.2-5.el9_0) for multiple architectures (ppc64le, x86_64, aarch64, s390x) that fix these issues. The vulnerabilities are categorized under CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). No CVSS scores are provided in the advisory, and no known exploits have been reported.

The heap buffer overflow vulnerability (CVE-2025-67873) can lead to denial of service or arbitrary code execution, which poses a significant risk to affected systems. The memory corruption vulnerability (CVE-2025-68114) also compromises system stability and security. Both vulnerabilities affect the capstone disassembly framework used in Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Exploitation could allow attackers to disrupt services or execute malicious code with the privileges of the affected application.

Red Hat has released updated capstone packages (version 4.0.2-5.el9_0) that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions should apply the security update promptly by following the instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory. There are no known exploits in the wild, and the update fully resolves the issues.