CVE-2025-6274

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-6274
A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been classified as problematic. Affected is the function OnDataCount of the file src/interp/binary-reader-interp.cc. The manipulation leads to resource consumption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect "real world wasm programs". Therefore, this entry might get disputed as well in the future.
CVSS

No CVSS.

References
Link Resource
https://github.com/user-attachments/files/20191325/wabt_crash_4.txt Exploit
https://github.com/WebAssembly/wabt/issues/2598 Exploit Issue Tracking
https://github.com/WebAssembly/wabt/issues/2598 Exploit Issue Tracking
https://vuldb.com/?ctiid.313278 Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?id.313278 Third Party Advisory VDB Entry
https://vuldb.com/?submit.593016 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:webassembly:wabt:*:*:*:*:*:*:*:*
History

02 Jul 2025, 18:33

Type Values Removed Values Added
First Time Webassembly
Webassembly wabt
References () https://github.com/WebAssembly/wabt/issues/2598 - () https://github.com/WebAssembly/wabt/issues/2598 - Exploit, Issue Tracking
References () https://vuldb.com/?ctiid.313278 - () https://vuldb.com/?ctiid.313278 - Permissions Required, Third Party Advisory, VDB Entry
References () https://vuldb.com/?id.313278 - () https://vuldb.com/?id.313278 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.593016 - () https://vuldb.com/?submit.593016 - Third Party Advisory, VDB Entry
References () https://github.com/user-attachments/files/20191325/wabt_crash_4.txt - () https://github.com/user-attachments/files/20191325/wabt_crash_4.txt - Exploit
CPE cpe:2.3:a:webassembly:wabt:*:*:*:*:*:*:*:*

23 Jun 2025, 20:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 3.3 		v2 : unknown
v3 : unknown
CWE CWE-404
CWE-400

19 Jun 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-19 19:15

Updated : 2025-07-02 18:33

NVD link : CVE-2025-6274

Mitre link : CVE-2025-6274

JSON object : View

Products Affected

webassembly

  • wabt
CWE

No CWE.