CVE-2025-6273 | THREATINT

Description

A vulnerability was found in WebAssembly wabt up to 1.0.37 and classified as problematic. This issue affects the function LogOpcode of the file src/binary-reader-objdump.cc. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains that this issue might not affect "real world wasm programs".

Eine problematische Schwachstelle wurde in WebAssembly wabt bis 1.0.37 gefunden. Dies betrifft die Funktion LogOpcode der Datei src/binary-reader-objdump.cc. Durch Manipulieren mit unbekannten Daten kann eine reachable assertion-Schwachstelle ausgenutzt werden. Umgesetzt werden muss der Angriff lokal. Der Exploit steht zur öffentlichen Verfügung. Bisher konnte die Existenz der vermeintlichen Schwachstelle noch nicht eindeutig nachgewiesen werden.

Reserved 2025-06-19 | Published 2025-06-19 | Updated 2025-06-19 | Assigner VulDB

MEDIUM: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

LOW: 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

LOW: 3.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

1.7AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR

Problem types

Reachable Assertion

Product status

1.0.0

affected

1.0.1

affected

1.0.2

affected

1.0.3

affected

1.0.4

affected

1.0.5

affected

1.0.6

affected

1.0.7

affected

1.0.8

affected

1.0.9

affected

1.0.10

affected

1.0.11

affected

1.0.12

affected

1.0.13

affected

1.0.14

affected

1.0.15

affected

1.0.16

affected

1.0.17

affected

1.0.18

affected

1.0.19

affected

1.0.20

affected

1.0.21

affected

1.0.22

affected

1.0.23

affected

1.0.24

affected

1.0.25

affected

1.0.26

affected

1.0.27

affected

1.0.28

affected

1.0.29

affected

1.0.30

affected

1.0.31

affected

1.0.32

affected

1.0.33

affected

1.0.34

affected

1.0.35

affected

1.0.36

affected

1.0.37

affected

Timeline

2025-06-19:	Advisory disclosed
2025-06-19:	VulDB entry created
2025-06-19:	VulDB entry last update

Credits

JJLeo (VulDB User) reporter

References

vuldb.com/?id.313277 (VDB-313277 | WebAssembly wabt binary-reader-objdump.cc LogOpcode assertion) vdb-entry technical-description

vuldb.com/?ctiid.313277 (VDB-313277 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/?submit.593010 (Submit #593010 | WebAssembly wabt wabt 1.0.37 (commit a60eb26) Reachable Assertion) third-party-advisory

github.com/WebAssembly/wabt/issues/2574 issue-tracking

github.com/user-attachments/files/19529411/wabt_crash.txt exploit

cve.org (CVE-2025-6273)

nvd.nist.gov (CVE-2025-6273)

Download JSON