WebAssembly wabt 1.0.36 Malformed File binary-reader-interp.cc OnExport heap-based overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in WebAssembly wabt 1.0.36. The impacted element is the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport of the file wabt/src/interp/binary-reader-interp.cc of the component Malformed File Handler. The manipulation leads to heap-based overflow. This vulnerability is uniquely identified as CVE-2025-2368. The attack is possible to be carried out remotely. Moreover, an exploit is present. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport of the file wabt/src/interp/binary-reader-interp.cc of the component Malformed File Handler. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-2368. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known.

The exploit is available at github.com. It is declared as proof-of-concept.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• WebAssembly

Name

• wabt

Version

• 1.0.36

Website

• Product: https://github.com/WebAssembly/wabt/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #515327: https://github.com/WebAssembly/wabt wabt v1.0.36 Heap-based Buffer Overflow (by github.com)

Duplicate

• Submit #XXXXXX: Xxxxxxxxxxx Xxxx Xxxx X.x.xx (xxxxxx Xxxxxxx) Xxx-xx-xxxxxx Xxxx (by JJLeo)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion