CVE-2025-6273mediumCWE-617

CVE-2025-6273: medium-severity vulnerability in WebAssembly wabt

WebAssembly wabt binary-reader-objdump.cc LogOpcode assertion

Published · Updated

Follow this CVE+ Monitor wabt+ Monitor wabt

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.8epss 0.2%
A vulnerability was found in WebAssembly wabt up to 1.0.37 and classified as problematic. This issue affects the function LogOpcode of the file src/binary-reader-objdump.cc. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains that this issue might not affect "real world wasm programs".
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
WebAssembly · wabt
Related CVEs — WebAssembly wabt

In the same product, most dangerous first.

CVE-2025-3122LOWWebAssembly wabt binary-reader-interp.cc BeginFunctionBody null pointer dereferenceEPSS 0.6%CVE-2025-2368MEDIUMWebAssembly wabt Malformed File binary-reader-interp.cc OnExport heap-based overflowEPSS 0.6%CVE-2025-2584LOWWebAssembly wabt binary-reader-interp.cc GetReturnCallDropKeepCount heap-based overflowEPSS 0.5%CVE-2025-6275MEDIUMWebAssembly wabt binary-reader-interp.cc GetFuncOffset use after freeEPSS 0.2%CVE-2025-6274MEDIUMWebAssembly wabt binary-reader-interp.cc OnDataCount resource consumptionEPSS 0.2%CVE-2025-15412MEDIUMWebAssembly wabt wasm-decompile VarName out-of-boundsEPSS 0.2%