CVSS 4.0
5.3 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NCVE-2025-2368
Medium (5.3) in webassembly wabt. EPSS 0.6% chance of exploitation in the next 30 days.
A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport of the file wabt/src/interp/binary-reader-interp.cc of the component Malformed File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
Severity
CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-787, CWE-119, CWE-122
- Published
- Modified
- Record from
- the NVD, synced
Affected
- webassembly:wabt
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| PYSEC-2025-227 | PyPI | wabt-bin | <=1.0.36 | no fix published |