Log in Start free

Vulnerability · Published Apr 2, 2025 · Assigned by VulDB

CVE-2025-3122WebAssembly wabt binary-reader-interp.cc BeginFunctionBody null pointer dereference

Low 3.1

In plain English

A low-severity null pointer dereference in wabt from WebAssembly. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.6%top 50.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic was found in WebAssembly wabt 1.0.36. Affected by this vulnerability is the function BinaryReaderInterp::BeginFunctionBody of the file src/interp/binary-reader-interp.cc. The manipulation leads to null pointer dereference. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12wabtno fix listedDEBIAN-CVE-2025-3122
Debian:13wabtno fix listedDEBIAN-CVE-2025-3122
Debian:14wabtno fix listedDEBIAN-CVE-2025-3122
PyPIwabt-binno fix listedPYSEC-2025-229
Ubuntu:22.04:LTSwabtno fix listedUBUNTU-CVE-2025-3122
Ubuntu:24.04:LTSwabtno fix listedUBUNTU-CVE-2025-3122
Ubuntu:25.10wabtno fix listedUBUNTU-CVE-2025-3122
Ubuntu:26.04:LTSwabtno fix listedUBUNTU-CVE-2025-3122
Ubuntu:26.10wabtno fix listedUBUNTU-CVE-2025-3122

Affected products (as reported)

VendorProductVersions
WebAssembly wabt 1.0.36

Weakness: CWE-476, CWE-404 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

References