Log in Start free

Vulnerability · Published Jun 19, 2025 · Assigned by VulDB

CVE-2025-6273WebAssembly wabt binary-reader-objdump.cc LogOpcode assertion

Low 3.3

In plain English

A low-severity security flaw in wabt from WebAssembly. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 85.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in WebAssembly wabt up to 1.0.37 and classified as problematic. This issue affects the function LogOpcode of the file src/binary-reader-objdump.cc. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains that this issue might not affect "real world wasm programs".

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12wabtno fix listedDEBIAN-CVE-2025-6273
Debian:13wabtno fix listedDEBIAN-CVE-2025-6273
Debian:14wabtno fix listedDEBIAN-CVE-2025-6273
Ubuntu:22.04:LTSwabtno fix listedUBUNTU-CVE-2025-6273
Ubuntu:24.04:LTSwabtno fix listedUBUNTU-CVE-2025-6273
Ubuntu:25.10wabtno fix listedUBUNTU-CVE-2025-6273
Ubuntu:26.04:LTSwabtno fix listedUBUNTU-CVE-2025-6273
Ubuntu:26.10wabtno fix listedUBUNTU-CVE-2025-6273

Affected products (as reported)

VendorProductVersions
WebAssembly wabt 1.0.01.0.11.0.21.0.31.0.41.0.51.0.61.0.7

Weakness: CWE-617 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

References