id: PYSEC-2025-227
published: "2025-03-17T08:15:11.493Z"
modified: "2026-01-06T16:29:46.463Z"
aliases:
- CVE-2025-2368
details: A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport of the file wabt/src/interp/binary-reader-interp.cc of the component Malformed File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
affected:
- package:
    name: wabt-bin
    ecosystem: PyPI
    purl: pkg:pypi/wabt-bin
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - last_affected: 1.0.36
  ecosystem_specific: {}
references:
- type: ADVISORY
  url: https://vuldb.com/?id.299867
- type: ADVISORY
  url: https://vuldb.com/?submit.515327
- type: REPORT
  url: https://github.com/WebAssembly/wabt/issues/2537
- type: REPORT
  url: https://github.com/WebAssembly/wabt/issues/2556
- type: REPORT
  url: "https://github.com/WebAssembly/wabt/issues/2556#issue-2899598349"
- type: REPORT
  url: https://github.com/WebAssembly/wabt/pull/2541
- type: REPORT
  url: https://vuldb.com/?ctiid.299867
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H