Bug 2352871 (CVE-2025-2368)

Summary: CVE-2025-2368 wabt: WebAssembly wabt Malformed File binary-reader-interp.cc OnExport heap-based overflow
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: gotiwari, jhorak, mvyas, tpopela
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was discovered in WebAssemby wabt. In affected versions, a heap-based buffer overflow condition may be triggered when processing certain malformed files. This may lead to an application crash or other undefined behavior.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2355629    
Bug Blocks:    

Description OSIDB Bzimport 2025-03-17 09:01:08 UTC 
A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport of the file wabt/src/interp/binary-reader-interp.cc of the component Malformed File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
Comment 2 Dominik 'Rathann' Mierzejewski 2025-06-03 11:20:39 UTC 
https://github.com/advisories/GHSA-rqch-2mmw-28wc