NULL pointer dereference in Webassembly Binaryen
CVE-2025-14957
A vulnerability was identified in WebAssembly Binaryen up to 125. This affects the function IRBuilder::makeLocalGet/IRBuilder::makeLocalSet/IRBuilder::makeLocalTee of the file src/wasm/wasm-ir-builder.cpp of the component IRBuilder. Such manipulation of the argument Index leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is 6fb2b917a79578ab44cf3b900a6da4c27251e0d4. Applying a patch is advised to resolve this issue.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.002 (10.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 10th percentile — 10.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
- Webassembly Binaryen — versions 125
Weakness classification (CWE)
References
- vuldb.com/ (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
- vuldb.com/ (signature, Permissions Required, permissions-required, VDB Entry)
- vuldb.com/ (VDB Entry, Third Party Advisory, third-party-advisory)
- vuldb.com/ (VDB Entry, Third Party Advisory, third-party-advisory)
- github.com/WebAssembly/binaryen/issues/8090 (issue-tracking, Exploit, Third Party Advisory, Issue Tracking)
- github.com/WebAssembly/binaryen/pull/8099 (issue-tracking, Issue Tracking)
- github.com/oneafter/1204/blob/main/af1 (exploit, Not Applicable)
- github.com/WebAssembly/binaryen/commit/6fb2b917a79578ab44cf3b900a6da4c27251e0d4 (Patch, patch)
- github.com/WebAssembly/binaryen/ (product)
Frequently asked questions
- What is CVE-2025-14957?
- CVE-2025-14957 is a low-severity vulnerability in Webassembly Binaryen, classified under Improper Resource Shutdown or Release. CVSS score: 3.3/10. Published 2025-12-19.
- How severe is CVE-2025-14957?
- Low severity. CVSS v3 base score is 3.3 out of 10.