PT-2025-26237 · Unknown+1 · Webassembly Wabt+1

Jjleo · Published 2025-06-19 · Updated 2025-07-02 · CVE-2025-6275

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions WebAssembly wabt versions 1.0.37 and earlier

Description A vulnerability was found in the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

Recommendations For versions 1.0.37 and earlier, consider updating to a version later than 1.0.37 to resolve the issue. As a temporary workaround, consider disabling the GetFuncOffset function until a patch is available.

Exploit

Fix

Use After Free

Buffer Overflow

Weakness Enumeration

CWE-416

CWE-119

Related Identifiers

CVE-2025-6275

Affected Products

Debian

Webassembly Wabt

References · 17

• 🔥 https://github.com/WebAssembly/wabt/issues/2614 · Exploit
• 🔥❌ https://github.com/user-attachments/files/20623626/wabt_crash_5.txt · Exploit, Deleted
• https://security-tracker.debian.org/tracker/CVE-2025-6275 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-6275 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6275 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-6275 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-6275 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6275 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6275 · Vendor Advisory
• https://t.me/cvetracker/26586 · Telegram Post
• https://vuldb.com/?id.313279 · Note
• https://vuldb.com/?ctiid.313279 · Note
• https://t.me/cvenotify/127474 · Telegram Post
• https://t.me/cvenotify/126176 · Telegram Post
• https://vuldb.com/?submit.593017 · Note