CVE-2025-14957 | THREATINT

Description

A vulnerability was identified in WebAssembly Binaryen up to 125. This affects the function IRBuilder::makeLocalGet/IRBuilder::makeLocalSet/IRBuilder::makeLocalTee of the file src/wasm/wasm-ir-builder.cpp of the component IRBuilder. Such manipulation of the argument Index leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is 6fb2b917a79578ab44cf3b900a6da4c27251e0d4. Applying a patch is advised to resolve this issue.

PUBLISHED Reserved 2025-12-19 | Published 2025-12-19 | Updated 2025-12-19 | Assigner VulDB

MEDIUM: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

LOW: 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

LOW: 3.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

1.7AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C

Problem types

NULL Pointer Dereference

Denial of Service

Product status

125

affected

Timeline

2025-12-19:	Advisory disclosed
2025-12-19:	VulDB entry created
2025-12-19:	VulDB entry last update

Credits

Oneafter (VulDB User) reporter

References

vuldb.com/?id.337593 (VDB-337593 | WebAssembly Binaryen IRBuilder wasm-ir-builder.cpp makeLocalTee null pointer dereference) vdb-entry technical-description

vuldb.com/?ctiid.337593 (VDB-337593 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/?submit.717317 (Submit #717317 | WebAssembly binaryen e7706b3 Memory Corruption) third-party-advisory

vuldb.com/?submit.717319 (Submit #717319 | WebAssembly binaryen e7706b3 Memory Corruption (Duplicate)) third-party-advisory

github.com/WebAssembly/binaryen/issues/8090 issue-tracking

github.com/WebAssembly/binaryen/pull/8099 issue-tracking

github.com/oneafter/1204/blob/main/af1 exploit

github.com/...ommit/6fb2b917a79578ab44cf3b900a6da4c27251e0d4 patch

cve.org (CVE-2025-14957)

nvd.nist.gov (CVE-2025-14957)

Download JSON