Log in Start free

Vulnerability · Published Dec 19, 2025 · Assigned by VulDB

CVE-2025-14957WebAssembly Binaryen IRBuilder wasm-ir-builder.cpp makeLocalTee null pointer dereference

Low 3.3

In plain English

A low-severity null pointer dereference in Binaryen from WebAssembly. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 88.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in WebAssembly Binaryen up to 125. This affects the function IRBuilder::makeLocalGet/IRBuilder::makeLocalSet/IRBuilder::makeLocalTee of the file src/wasm/wasm-ir-builder.cpp of the component IRBuilder. Such manipulation of the argument Index leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is 6fb2b917a79578ab44cf3b900a6da4c27251e0d4. Applying a patch is advised to resolve this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24binaryen129-r0ALPINE-CVE-2025-14957
Debian:12binaryenno fix listedDEBIAN-CVE-2025-14957
Debian:13binaryenno fix listedDEBIAN-CVE-2025-14957
Debian:14binaryen130-2DEBIAN-CVE-2025-14957
Ubuntu:22.04:LTSbinaryenno fix listedUBUNTU-CVE-2025-14957
Ubuntu:24.04:LTSbinaryenno fix listedUBUNTU-CVE-2025-14957
Ubuntu:25.10binaryenno fix listedUBUNTU-CVE-2025-14957
Ubuntu:26.04:LTSbinaryenno fix listedUBUNTU-CVE-2025-14957
Ubuntu:26.10binaryenno fix listedUBUNTU-CVE-2025-14957

Affected products (as reported)

VendorProductVersions
WebAssembly Binaryen 125

Weakness: CWE-476, CWE-404 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References