PT-2025-52497 · Unknown+1 · Webassembly Binaryen+1

Oneafter · Published 2025-12-19 · Updated 2025-12-30 · CVE-2025-14957

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions WebAssembly Binaryen versions prior to 126

Description A flaw exists in the IRBuilder component of WebAssembly Binaryen. Specifically, the functions IRBuilder::makeLocalGet, IRBuilder::makeLocalSet, and IRBuilder::makeLocalTee within the src/wasm/wasm-ir-builder.cpp file are susceptible to a null pointer dereference due to manipulation of the Index argument. Local access is required for exploitation. The exploit is publicly available.

Recommendations Apply the patch 6fb2b917a79578ab44cf3b900a6da4c27251e0d4.

Exploit

Fix

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

CVE-2025-14957

Affected Products

Debian

Webassembly Binaryen

References · 21

• 🔥 https://github.com/WebAssembly/binaryen/issues/8090 · Exploit
• 🔥 https://github.com/oneafter/1204/blob/main/af1 · Exploit
• https://github.com/WebAssembly/binaryen/commit/6fb2b917a79578ab44cf3b900a6da4c27251e0d4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-14957 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-14957 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-14957 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-14957 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-14957 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-14957 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-14957 · Vendor Advisory
• https://github.com/WebAssembly/binaryen/pull/8099 · Note
• https://t.me/cveNotify/146365 · Telegram Post
• https://vuldb.com/?id.337593 · Note
• https://vuldb.com/?ctiid.337593 · Note
• https://github.com/WebAssembly/binaryen · Note