Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-6273: wabt up to 1.0.37 may crash during processing

CVE-2025-6273 · published 1 year ago

Summary

The wabt program used for WebAssembly files (versions up to 1.0.37) can hit an internal check that stops the program from running. This requires someone who already has access to the machine and is unlikely to affect typical WebAssembly code in production. Updating to a newer wabt release or rebuilding the tool from source eliminates the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	wabt	All versions
Debian:13	debian	wabt	All versions
Debian:14	debian	wabt	All versions
–	webassembly	wabt	<= 1.0.37 `cpe:2.3:a:webassembly:wabt::::::::`
Ubuntu:20.04:LTS	canonical	wabt	All versions

Original advisory text

WebAssembly wabt binary-reader-objdump.cc LogOpcode assertion

A vulnerability was found in WebAssembly wabt up to 1.0.37 and classified as problematic. This issue affects the function LogOpcode of the file src/binary-reader-objdump.cc. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains that this issue might not affect "real world wasm programs".

References

https://security-tracker.debian.org/tracker/CVE-2025-6273 Vendor Advisory
https://ubuntu.com/security/CVE-2025-6273 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-6273 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6273.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-6273 Vendor Advisory
https://github.com/WebAssembly/wabt/issues/2574 Third Party Advisory
https://github.com/user-attachments/files/19529411/wabt_crash.txt Third Party Advisory
https://vuldb.com/?ctiid.313277 Third Party Advisory
https://vuldb.com/?id.313277 Third Party Advisory
https://vuldb.com/?submit.593010 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-617Reachable Assertion

Timeline

Published19 Jun 2025

Updated4 Nov 2026

First seen1 Sep 2026

Sources

DEBIAN-CVE-2025-6273 · OSV

CVE-2025-6273 · NVD

UBUNTU-CVE-2025-6273 · OSV

CVE-2025-6273 · OSV

Track software like this

Free during beta