The Capstone disassembly framework included in Red Hat Enterprise Linux 9.4 Extended Update Support and related CodeReady Linux Builder products contains two vulnerabilities: CVE-2025-68114, a memory corruption issue caused by an unchecked vsnprintf return, and CVE-2025-67873, a heap buffer overflow via the skipdata callback. These vulnerabilities can result in denial of service or arbitrary code execution. Red Hat Product Security has released an updated package (capstone-4.0.2-11.el9_4) that fixes these issues. The advisory RHSA-2026:5125 provides details on the update and affected packages across multiple architectures including x86_64, s390x, ppc64le, and aarch64. The update is classified as having moderate severity. No known exploits in the wild have been reported at this time.

Successful exploitation of CVE-2025-67873 can lead to denial of service or arbitrary code execution due to a heap buffer overflow in the skipdata callback of Capstone. CVE-2025-68114 can cause memory corruption via an unchecked vsnprintf return. Both vulnerabilities affect the integrity and availability of systems running vulnerable versions of Capstone in Red Hat Enterprise Linux 9.4 Extended Update Support and related products. There are no reports of known exploits in the wild.

Red Hat has released an official security update for Capstone in Red Hat Enterprise Linux 9.4 Extended Update Support and related CodeReady Linux Builder products. Users should apply the updated packages (capstone-4.0.2-11.el9_4) provided by Red Hat to remediate these vulnerabilities. Refer to the Red Hat advisory RHSA-2026:5125 and the update instructions at https://access.redhat.com/articles/11258 for detailed guidance. No additional mitigation steps are indicated by the vendor.