EUVD-2025-18693Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack, low privileges, no user interaction, only availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been classified as problematic. Affected is the function OnDataCount of the file src/interp/binary-reader-interp.cc. The manipulation leads to resource consumption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect "real world wasm programs". Therefore, this entry might get disputed as well in the future.
AnalysisAI
Resource consumption vulnerability in WebAssembly wabt up to 1.0.37 allows local attackers to cause denial of service via the OnDataCount function in src/interp/binary-reader-interp.cc. Publicly available exploit code exists, but EPSS score is low (0.05%) and no active exploitation has been confirmed.
Technical ContextAI
The vulnerability resides in the WebAssembly Binary Toolkit (wabt), a toolchain for WebAssembly binaries. The affected function OnDataCount in the interpreter's binary reader processes the DataCount section of a WebAssembly module. The root cause is a CWE-400 (Uncontrolled Resource Consumption), where a crafted input can cause excessive resource usage, leading to denial of service. CPE data confirms all versions up to 1.0.37 are affected.
RemediationAI
Upgrade to the latest patched version of wabt beyond 1.0.37. The vendor has released a fix; refer to the GitHub issue at https://github.com/WebAssembly/wabt/issues/2598 for details. As a workaround, avoid processing untrusted WebAssembly binaries with the interpreter, or restrict local access to the tool.
Sandbox escape in wasm2c (wabt ≤ 1.0.41) allows an attacker controlling WebAssembly content to achieve arbitrary read/wr
wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr->GetRetur
wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDro
WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild. Rated
wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write. Rated medium severity (CVSS 5.5), this vulnerabilit
A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical.cc of the component Malformed File Handl
A vulnerability was found in WebAssembly wabt 1.0.36. Rated low severity (CVSS 2.3), this vulnerability is remotely expl
Use-after-free vulnerability in WebAssembly wabt up to 1.0.37 allows local attackers to cause a denial of service via cr
Reachable assertion in WebAssembly wabt up to 1.0.37 via the LogOpcode function in src/binary-reader-objdump.cc allows l
A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::Inse
A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decom
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| noble | needs-triage | - |
| plucky | ignored | end of life, was needs-triage |
| upstream | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| oracular | ignored | end of life, was needs-triage |
| questing | needs-triage | - |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 1.0.20-1 | - |
| bookworm | vulnerable | 1.0.32-1 | - |
| forky, sid, trixie | vulnerable | 1.0.36+dfsg+~cs1.0.36-2 | - |
| (unstable) | fixed | (unfixed) | unimportant |
Share
External POC / Exploit Code
Leaving vuln.today