webassembly wabt vulnerabilities

Latest webassembly wabt CVEs

Newest publication first

1. CVE-2026-90648 wabt: RLBox: WasmBoxC: firefox: wasm2c: Sandbox escape via memory allocation failure

   Published 2026-09-12

   High·CVSS 7.1 EPSS 0.19%

   wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc() in wasm_rt_allocate_funcref_table() (wasm2c/wasm-rt-impl-tableops.inc). When the f...

2. CVE-2025-15412 WebAssembly wabt wasm-decompile VarName out-of-bounds

   Published 2026-01-01

   Medium·CVSS 4.8 EPSS 0.21%

   A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. Such manipulation leads to out-of-bounds read. Local access is re...

3. CVE-2025-15411 WebAssembly wabt wasm-decompile InsertNode memory corruption

   Published 2026-01-01

   Medium·CVSS 4.8 EPSS 0.21%

   A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. This manipulation causes memory corruption. It is possible to launch the...

4. CVE-2025-6275 WebAssembly wabt binary-reader-interp.cc GetFuncOffset use after free

   Published 2025-06-19

   Medium·CVSS 4.8 EPSS 0.25%

   A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the att...

5. CVE-2025-6274 WebAssembly wabt binary-reader-interp.cc OnDataCount resource consumption

   Published 2025-06-19

   Medium·CVSS 4.8 EPSS 0.24%

   A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been classified as problematic. Affected is the function OnDataCount of the file src/interp/binary-reader-interp.cc. The manipulation leads to resource consumption. Attacking locally is a requirement. The exploit...

6. CVE-2025-3122 WebAssembly wabt binary-reader-interp.cc BeginFunctionBody null pointer dereference

   Published 2025-04-02

   Low·CVSS 2.3 EPSS 0.61%

   A vulnerability classified as problematic was found in WebAssembly wabt 1.0.36. Affected by this vulnerability is the function BinaryReaderInterp::BeginFunctionBody of the file src/interp/binary-reader-interp.cc. The manipulation leads to null pointer dereference. The attack can...

7. CVE-2025-2584 WebAssembly wabt binary-reader-interp.cc GetReturnCallDropKeepCount heap-based overflow

   Published 2025-03-21

   Low·CVSS 2.3 EPSS 0.51%

   A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCallDropKeepCount of the file wabt/src/interp/binary-reader-interp.cc. The manipulation leads to heap-based buffer overflow...

8. CVE-2025-2368 WebAssembly wabt Malformed File binary-reader-interp.cc OnExport heap-based overflow

   Published 2025-03-17

   Medium·CVSS 5.3 EPSS 0.57%

   A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport of the file wabt/src/interp/binary-reader-interp.cc of the component Malformed File Handler. The mani...

9. CVE-2023-27119 WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild.

   Published 2023-03-10

   Medium·CVSS 5.5 EPSS 0.28%

   WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild.

10. CVE-2022-43283 wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write.

    Published 2022-10-28

    Medium·CVSS 5.5 EPSS 0.29%

    wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write.

11. CVE-2022-43282 wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr->GetReturnCallDropKeepCount.

    Published 2022-10-28

    High·CVSS 7.1 EPSS 0.32%

    wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr->GetReturnCallDropKeepCount.

12. CVE-2022-43280 wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDropKeepCount.

    Published 2022-10-28

    High·CVSS 7.1 EPSS 0.32%

    wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDropKeepCount.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.