EUVD-2025-18695Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector, low privileges, no user interaction, only availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect "real world wasm programs". Therefore, this entry might get disputed as well in the future.
AnalysisAI
Use-after-free vulnerability in WebAssembly wabt up to 1.0.37 allows local attackers to cause a denial of service via crafted input. Public exploit code exists, but exploitation requires local access and low privileges. EPSS score is low (0.05%), and no active exploitation in CISA KEV has been reported.
Technical ContextAI
The vulnerability is a use-after-free (CWE-119) in the GetFuncOffset function of src/interp/binary-reader-interp.cc. This occurs when parsing malformed WebAssembly binaries, leading to memory corruption. The affected product is wabt (WebAssembly Binary Toolkit), a widely used toolchain for WebAssembly development. CPE data confirms all versions up to 1.0.37 are affected.
RemediationAI
Upgrade to the latest patched version of wabt (if available) or apply the fix from the upstream repository. As a workaround, avoid processing untrusted WebAssembly binaries with wabt. Monitor the vendor's GitHub for official patch releases. No specific patch version is confirmed in the input, but the vendor has acknowledged the issue.
Sandbox escape in wasm2c (wabt ≤ 1.0.41) allows an attacker controlling WebAssembly content to achieve arbitrary read/wr
wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr->GetRetur
wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDro
WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild. Rated
wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write. Rated medium severity (CVSS 5.5), this vulnerabilit
A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical.cc of the component Malformed File Handl
A vulnerability was found in WebAssembly wabt 1.0.36. Rated low severity (CVSS 2.3), this vulnerability is remotely expl
Resource consumption vulnerability in WebAssembly wabt up to 1.0.37 allows local attackers to cause denial of service vi
Reachable assertion in WebAssembly wabt up to 1.0.37 via the LogOpcode function in src/binary-reader-objdump.cc allows l
A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::Inse
A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decom
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| plucky | ignored | end of life, was needs-triage |
| upstream | needs-triage | - |
| oracular | ignored | end of life, was needs-triage |
| questing | needs-triage | - |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 1.0.20-1 | - |
| bookworm | vulnerable | 1.0.32-1 | - |
| forky, sid, trixie | vulnerable | 1.0.36+dfsg+~cs1.0.36-2 | - |
| (unstable) | fixed | (unfixed) | unimportant |
Share
External POC / Exploit Code
Leaving vuln.today