Which versions of wasm3 are affected by CVE-2025-6272?

CVE-2025-6272 is a low-severity vulnerability in A vulnerability (CVSS 3.3). The limited severity suggests constrained impact, typically requiring specific conditions or local access for…

Is there a public PoC exploit available for CVE-2025-6272?

Yes, a public proof-of-concept exploit is available for CVE-2025-6272. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-6272?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

wasm3 CVE-2025-6272

Q: What is the CVSS score of CVE-2025-6272?

CVE-2025-6272 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-18691 LOW

Buffer Overflow (CWE-119)

2025-06-19 cna@vuldb.com

Buffer Overflow Wasm3 Wasm3 Project

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.3 LOW

Local attack, low complexity, low privileges, no user interaction, only availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.3 (LOW) 1.9 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 00:08 euvd

EUVD-2025-18691

Analysis Generated

Mar 15, 2026 - 00:08 vuln.today

PoC Detected

Jul 02, 2025 - 19:04 vuln.today

Public exploit code

CVE Published

Jun 19, 2025 - 18:15 nvd

LOW 3.3

CVE Published

Jun 19, 2025 - 18:15 cve.org

LOW 1.9

DescriptionCVE.org

A vulnerability has been found in wasm3 0.5.0 and classified as problematic. This vulnerability affects the function MarkSlotAllocated of the file source/m3_compile.c. The manipulation leads to out-of-bounds write. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

AnalysisAI

Out-of-bounds write in wasm3 0.5.0 allows local attackers to cause a denial of service via a crafted WebAssembly module. The vulnerability is triggered in the MarkSlotAllocated function of source/m3_compile.c. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.05%).

Technical ContextAI

wasm3 is a lightweight WebAssembly interpreter written in C. The vulnerability is a classic buffer overflow (CWE-119) in the compilation phase, specifically in the MarkSlotAllocated function. The CPE indicates wasm3 version 0.5.0 is affected. The root cause is improper bounds checking when allocating slots during bytecode compilation, leading to an out-of-bounds write.

RemediationAI

No vendor-released patch identified at time of analysis. Users should monitor the wasm3 GitHub repository for updates. As a workaround, avoid running untrusted WebAssembly modules with wasm3 0.5.0. Consider using a different WebAssembly runtime or restricting local access to the interpreter. The trade-off is reduced functionality or compatibility.