CVE-2025-2368
Published: 17 March 2025
Summary
CVE-2025-2368 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Webassembly Wabt. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 41.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-2368 is a critical heap-based buffer overflow vulnerability in WebAssembly wabt version 1.0.36. It affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport in the file wabt/src/interp/binary-reader-interp.cc within the Malformed File Handler component.
The vulnerability can be exploited remotely by an unauthenticated attacker who manipulates a malformed file. Exploitation requires user interaction, such as opening or processing the file in an affected application. Successful attacks result in low-impact confidentiality, integrity, and availability violations, with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). Associated weakness identifiers include CWE-119, CWE-122, and CWE-787.
Advisories in GitHub issues #2537 and #2556, along with pull request #2541 in the WebAssembly/wabt repository, detail the issue and provide a patch. The VulDB entry (ctiid.299867) recommends applying the patch to mitigate the vulnerability, noting that the exploit has been publicly disclosed and may be used.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6640
Vulnerability details
A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport of the file wabt/src/interp/binary-reader-interp.cc of the component Malformed File Handler. The manipulation leads to heap-based buffer overflow. The attack may be…
more
initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes exploitation of a heap buffer overflow in a malformed file handler via a crafted file requiring user interaction to open/process in an affected application, directly mapping to client-side exploitation and malicious file delivery.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the heap-based buffer overflow by requiring timely remediation through application of the available patch for wabt 1.0.36.
Provides memory protections such as ASLR and heap hardening to prevent successful exploitation of the buffer overflow in the BinaryReaderInterp::OnExport function.
Validates malformed WebAssembly file inputs before processing by the vulnerable Malformed File Handler component to block overflow triggers.