A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCallDropKeepCount of the file wabt/src/interp/binary-reader-interp.cc. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
References
| Link | Resource |
|---|---|
| https://github.com/WebAssembly/wabt/issues/2557 | Exploit Issue Tracking |
| https://github.com/WebAssembly/wabt/issues/2557#issue-2900405517 | Exploit Issue Tracking |
| https://vuldb.com/?ctiid.300544 | Permissions Required VDB Entry |
| https://vuldb.com/?id.300544 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.515406 | Third Party Advisory VDB Entry |
Configurations
History
24 Mar 2025, 14:02
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/WebAssembly/wabt/issues/2557 - Exploit, Issue Tracking | |
| References | () https://github.com/WebAssembly/wabt/issues/2557#issue-2900405517 - Exploit, Issue Tracking | |
| References | () https://vuldb.com/?id.300544 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?ctiid.300544 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?submit.515406 - Third Party Advisory, VDB Entry | |
| First Time |
Webassembly
Webassembly wabt |
|
| CWE | CWE-787 | |
| CPE | cpe:2.3:a:webassembly:wabt:1.0.36:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.4 |
21 Mar 2025, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-21 08:15
Updated : 2025-03-24 14:02
NVD link : CVE-2025-2584
Mitre link : CVE-2025-2584
JSON object : View
Products Affected
webassembly
- wabt