PT-2025-26236 · Unknown+1 · Webassembly Wabt+1

Jjleo · Published 2025-06-19 · Updated 2025-07-02 · CVE-2025-6274

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions WebAssembly wabt versions up to 1.0.37

Description A vulnerability has been found that leads to resource consumption. It affects the OnDataCount function of the file src/interp/binary-reader-interp.cc. The manipulation requires a local attack. A similar issue was previously reported and disputed by the code maintainer, suggesting it may not affect "real world wasm programs", which could lead to this entry being disputed as well.

Recommendations For versions up to 1.0.37, consider disabling the OnDataCount function as a temporary workaround until a patch is available. Restrict access to the binary-reader-interp.cc file to minimize the risk of exploitation. Avoid using the OnDataCount function in local environments until the issue is resolved.

Exploit

Fix

Resource Exhaustion

Improper Resource Release

Weakness Enumeration

CWE-400

CWE-404

Related Identifiers

CVE-2025-6274

Affected Products

Debian

Webassembly Wabt

References · 17

• 🔥 https://github.com/WebAssembly/wabt/issues/2598 · Exploit
• 🔥❌ https://github.com/user-attachments/files/20191325/wabt_crash_4.txt · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2025-6274 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-6274 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-6274 · Security Note
• https://ubuntu.com/security/CVE-2025-6274 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6274 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-6274 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-6274 · Vendor Advisory
• https://vuldb.com/?submit.593016 · Note
• https://t.me/cvenotify/127473 · Telegram Post
• https://twitter.com/CVEnew/status/1935787265520734215 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1935783125499416809 · Twitter Post
• https://vuldb.com/?ctiid.313278 · Note
• https://t.me/cvetracker/26585 · Telegram Post