NULL pointer dereference in Webassembly Binaryen
CVE-2025-14957
A vulnerability was identified in WebAssembly Binaryen up to 125. This affects the function IRBuilder::makeLocalGet/IRBuilder::makeLocalSet/IRBuilder::makeLocalTee of the file src/wasm/wasm-ir-builder.cpp of the component IRBuilder. Such manipulation of the argument Index leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is 6fb2b917a79578ab44cf3b900a6da4c27251e0d4. Applying a patch is advised to resolve this issue.
EPSS: 0.002 (8.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Webassembly Binaryen — versions 125
Weakness classification (CWE)
References
- cna@vuldb.com (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, Permissions Required, permissions-required, VDB Entry)
- cna@vuldb.com (VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (issue-tracking, Exploit, Third Party Advisory, Issue Tracking)
- cna@vuldb.com (issue-tracking, Issue Tracking)
- cna@vuldb.com (exploit, Not Applicable)
- cna@vuldb.com (Patch, patch)
- cna@vuldb.com (product)
Frequently asked questions
- What is CVE-2025-14957?
- CVE-2025-14957 is a low-severity vulnerability in Webassembly Binaryen, classified under Improper Resource Shutdown or Release. CVSS score: 3.3/10. Published 2025-12-19.
- How severe is CVE-2025-14957?
- Low severity. CVSS v3 base score is 3.3 out of 10.