Log in Start free

Vulnerability · Published Mar 17, 2025 · Assigned by VulDB

CVE-2025-2368WebAssembly wabt Malformed File binary-reader-interp.cc OnExport heap-based overflow

Medium 6.3

In plain English

A medium-severity heap buffer overflow in wabt from WebAssembly. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.6%top 52.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport of the file wabt/src/interp/binary-reader-interp.cc of the component Malformed File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12wabtno fix listedDEBIAN-CVE-2025-2368
Debian:13wabtno fix listedDEBIAN-CVE-2025-2368
Debian:14wabtno fix listedDEBIAN-CVE-2025-2368
PyPIwabt-binno fix listedPYSEC-2025-227
Ubuntu:22.04:LTSwabtno fix listedUBUNTU-CVE-2025-2368
Ubuntu:24.04:LTSwabtno fix listedUBUNTU-CVE-2025-2368
Ubuntu:25.10wabtno fix listedUBUNTU-CVE-2025-2368
Ubuntu:26.04:LTSwabtno fix listedUBUNTU-CVE-2025-2368
Ubuntu:26.10wabtno fix listedUBUNTU-CVE-2025-2368

Affected products (as reported)

VendorProductVersions
WebAssembly wabt 1.0.36

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References