Skip to main content

wabt EUVDEUVD-2025-18694

| CVE-2025-6273 LOW
Reachable Assertion (CWE-617)
2025-06-19 cna@vuldb.com
Denial Of Service Wabt Webassembly
1.9
CVSS 4.0 · NVD

Severity by source

NVD PRIMARY
1.9 LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.0 MEDIUM

Local attack vector, low complexity, no privileges, no user interaction, only availability impact.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Ubuntu
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

7
CVSS changed
Apr 29, 2026 - 01:11 NVD
3.3 (LOW) 1.9 (LOW)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 00:08 euvd
EUVD-2025-18694
Analysis Generated
Mar 15, 2026 - 00:08 vuln.today
PoC Detected
Jan 06, 2026 - 16:24 vuln.today
Public exploit code
CVE Published
Jun 19, 2025 - 19:15 nvd
LOW 3.3
CVE Published
Jun 19, 2025 - 19:15 cve.org
LOW 1.9

DescriptionCVE.org

A vulnerability was found in WebAssembly wabt up to 1.0.37 and classified as problematic. This issue affects the function LogOpcode of the file src/binary-reader-objdump.cc. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains that this issue might not affect "real world wasm programs".

AnalysisAI

Reachable assertion in WebAssembly wabt up to 1.0.37 via the LogOpcode function in src/binary-reader-objdump.cc allows local attackers to cause a denial of service. A public exploit exists, but the vendor doubts real-world impact and a patch is available. EPSS score is low (0.04%), indicating minimal exploitation risk.

Technical ContextAI

The vulnerability is a reachable assertion (CWE-617) in the wabt tool, specifically in the binary reader's objdump functionality. wabt is a WebAssembly Binary Toolkit used for debugging and analyzing .wasm files. The affected function LogOpcode processes opcodes during disassembly. The CPE cpe:2.3:a:webassembly:wabt:*:*:*:*:*:*:*:* indicates all versions up to 1.0.37 are affected. Assertion failures occur when an unexpected condition is met, leading to program termination.

RemediationAI

Upgrade to the latest patched version of wabt from the official repository. The vendor has provided a fix; refer to https://github.com/WebAssembly/wabt/issues/2574 for details. As a workaround, avoid using the objdump functionality on untrusted .wasm files, or restrict local access to the tool. Note that disabling the feature may impact debugging workflows.

More in Wabt

View all
CVE-2026-90648 HIGH POC
7.1 Sep 12

Sandbox escape in wasm2c (wabt ≤ 1.0.41) allows an attacker controlling WebAssembly content to achieve arbitrary read/wr
CVE-2022-43282 HIGH POC
7.1 Oct 28

wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr->GetRetur
CVE-2022-43280 HIGH POC
7.1 Oct 28

wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDro
CVE-2023-27119 MEDIUM POC
5.5 Mar 10

WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild. Rated

CVE-2022-43283 MEDIUM POC
5.5 Oct 28

wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write. Rated medium severity (CVSS 5.5), this vulnerabilit
CVE-2025-2368 MEDIUM POC
5.3 Mar 17

A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical.cc of the component Malformed File Handl
CVE-2025-2584 LOW POC
2.3 Mar 21

A vulnerability was found in WebAssembly wabt 1.0.36. Rated low severity (CVSS 2.3), this vulnerability is remotely expl
CVE-2025-6275 LOW POC
1.9 Jun 19

Use-after-free vulnerability in WebAssembly wabt up to 1.0.37 allows local attackers to cause a denial of service via cr
CVE-2025-6274 LOW POC
1.9 Jun 19

Resource consumption vulnerability in WebAssembly wabt up to 1.0.37 allows local attackers to cause denial of service vi
CVE-2025-15411 LOW POC
1.9 Jan 01

A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::Inse
CVE-2025-15412 LOW POC
1.9 Jan 01

A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decom

Same weakness CWE-617 – Reachable Assertion

View all
CVE-2025-15684 MEDIUM POC
5.5
CVE-2016-8864 HIGH
7.5
CVE-2020-12417 HIGH POC
8.8
CVE-2020-6623 HIGH POC
8.8
CVE-2020-6619 HIGH POC
8.8
CVE-2020-6617 HIGH POC
8.8
CVE-2023-37023 HIGH POC
8.6
CVE-2023-37021 HIGH POC
8.6

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
wabt
Release Status Version
upstream needs-triage -
focal needs-triage -
jammy needs-triage -
noble needs-triage -
oracular ignored end of life, was needs-triage
plucky ignored end of life, was needs-triage
questing needs-triage -

Debian

wabt
Release Status Fixed Version Urgency
bullseye vulnerable 1.0.20-1 -
bookworm vulnerable 1.0.32-1 -
forky, sid, trixie vulnerable 1.0.36+dfsg+~cs1.0.36-2 -
(unstable) fixed (unfixed) unimportant

Share

EUVD-2025-18694 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy