{"id":"CVE-2025-2584","state":"PUBLISHED","title":"WebAssembly wabt binary-reader-interp.cc GetReturnCallDropKeepCount heap-based overflow","description":"A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCallDropKeepCount of the file wabt/src/interp/binary-reader-interp.cc. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.","publishedAt":"2025-03-21T07:31:03.732Z","updatedAt":"2025-03-21T12:29:54.383Z","severity":{"score":2.3,"label":"Low","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["WebAssembly wabt"],"affected":[{"vendor":"WebAssembly","product":"wabt","versions":[{"version":"1.0.36","status":"affected"}]}],"references":["https://vuldb.com/?id.300544","https://vuldb.com/?ctiid.300544","https://vuldb.com/?submit.515406","https://github.com/WebAssembly/wabt/issues/2557","https://github.com/WebAssembly/wabt/issues/2557#issue-2900405517"],"weaknesses":["CWE-122","CWE-119"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/2xxx/CVE-2025-2584.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-2584","state":"PUBLISHED","datePublished":"2025-03-21T07:31:03.732Z","dateUpdated":"2025-03-21T12:29:54.383Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-03-20T23:01:41.046Z"},"containers":{"cna":{"title":"WebAssembly wabt binary-reader-interp.cc GetReturnCallDropKeepCount heap-based overflow","descriptions":[{"lang":"en","value":"A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCallDropKeepCount of the file wabt/src/interp/binary-reader-interp.cc. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"In WebAssembly wabt 1.0.36 wurde eine Schwachstelle ausgemacht. Sie wurde als kritisch eingestuft. Hierbei betrifft es die Funktion BinaryReaderInterp::GetReturnCallDropKeepCount der Datei wabt/src/interp/binary-reader-interp.cc. Mit der Manipulation mit unbekannten Daten kann eine heap-based buffer overflow-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Die Komplexität eines Angriffs ist eher hoch. Das Ausnutzen gilt als schwierig. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"WebAssembly","product":"wabt","versions":[{"version":"1.0.36","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.300544","name":"VDB-300544 | WebAssembly wabt binary-reader-interp.cc GetReturnCallDropKeepCount heap-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.300544","name":"VDB-300544 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.515406","name":"Submit #515406 | https://github.com/WebAssembly/wabt wabt v1.0.36 Heap-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/WebAssembly/wabt/issues/2557","tags":["issue-tracking"]},{"url":"https://github.com/WebAssembly/wabt/issues/2557#issue-2900405517","tags":["exploit","issue-tracking"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":2.3,"vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","baseSeverity":"LOW"}},{"cvssV3_1":{"version":"3.1","baseScore":5,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":5,"vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5.1,"vectorString":"AV:N/AC:H/Au:N/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-122","type":"CWE","lang":"en","description":"Heap-based Buffer Overflow"}]},{"descriptions":[{"cweId":"CWE-119","type":"CWE","lang":"en","description":"Memory Corruption"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-03-21T07:31:03.732Z"},"timeline":[{"time":"2025-03-20T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-03-21T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-03-21T00:06:44.000Z","lang":"en","value":"VulDB entry last update"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-21T12:29:43.060139Z","id":"CVE-2025-2584","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-21T12:29:54.383Z"}}]}}}