CVE-2022-43281

wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector::size at /bits/stlvector.h...

CVE-2021-32629

Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable machine code. There is a bug in 0.73 of the Cranelift x64 backend that can create a scenario that could result in a potential sandbox escape i...

CVE-2020-15681

When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten another's entry in a shared stub table, resulting in a potentially exploitable crash. This vulnerability affects Firefox 82...

CVE-2020-18378

A NULL pointer dereference was discovered in SExpressionWasmBuilder::makeBlock in wasm/wasm-s-parser.c in Binaryen 1.38.26. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-as...

CVE-2017-15368

The wasmdis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service stack-based buffer over-read and application crash or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect rhexbin2str call...

wamr:wamr_fuzz_fast_interp: Heap-buffer-overflow in wasm_loader_unload

Project: https://github.com/bytecodealliance/wasm-micro-runtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5172242176868352 Project: wamr Fuzzing Engine: libFuzzer Fuzz Target: wamrfuzzfastinterp Job Type: libfuzzerasanwamr Platform Id: linux Crash Type: Heap-buffer-overflow READ 8...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via the symlink creation process. An attacker can create or modify files outside of the intended sandboxed directory by creating a symlink that points to an external directory or file. Note: This is...

wasm-bindgen-0.2.97~0-3.1 on GA media (moderate)

wasm-bindgen-0.2.970-3.1 on GA media Announcement ID: openSUSE-SU-2025:15065-1 Rating: moderate Cross-References: CVE-2025-3416 CVSS scores: CVE-2025-3416 SUSE : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2025-3416 SUSE : 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA...

Malware in @di-sdk/quickselect-wasm

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Exploit for CVE-2025-31125

CVE-2025-31125 Exploit - Vite WASM Import Path Traversal 🛡️ T...

OPENSUSE-SU-2025:15065-1 wasm-bindgen-0.2.97~0-3.1 on GA media

These are all security issues fixed in the wasm-bindgen-0.2.970-3.1 package on the GA media of openSUSE Tumbleweed...

wamr:wamr_fuzz_llvm_jit: Heap-buffer-overflow in load_from_sections

Project: https://github.com/bytecodealliance/wasm-micro-runtime.git Detailed Report: https://oss-fuzz.com/testcase?key=6748122586087424 Project: wamr Fuzzing Engine: libFuzzer Fuzz Target: wamrfuzzllvmjit Job Type: libfuzzerasanwamr Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

Malicious code in @di-sdk/quickselect-wasm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb4f93b792159c059a742b5ea3d59a8038b8e1be1103e430086184a2f3ca3090 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 41 Update: trunk-0.21.13-1.fc41

Build, bundle & ship your Rust WASM application to the web...

FreeBSD : mozilla -- 64 bit JIT WASM read on left over memroy (a93a1d2a-109d-11f0-8195-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a93a1d2a-109d-11f0-8195-b42e991fc52e advisory. [email protected] reports: On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pic...

OSV-2025-230 Heap-buffer-overflow in wasm_loader_prepare_bytecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=404921047 Crash type: Heap-buffer-overflow WRITE 8 Crash state: wasmloaderpreparebytecode loadfromsections wasmloaderload...

PT-2025-16151

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description The software contains a heap-buffer-overflow write issue. The crash occurs during the wasm loader load process, specifically within the wasm loader prepare...

Malicious code in tfjs-backend-wasm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8dd5fe4c6cb897fa912341a89f0b61c8bbadfe484b8f11d19195516e210e8452 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2581 Malicious code in tfjs-backend-wasm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8dd5fe4c6cb897fa912341a89f0b61c8bbadfe484b8f11d19195516e210e8452 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the `block_type_get_arity` function in the `core/iwasm/interpreter/wasm.h` file in the execution environment for WebAssembly applications, such as WebAssembly Micro Runtime (WAMR), allows a malicious actor to cause a service failure.

The vulnerability of the blocktypegetarity function in the core/iwasm/interpreter/wasm.h file, within the WebAssembly environment for WebAssembly Micro Runtime applications WAMR, involves reading beyond the permitted range of memory. Exploiting this vulnerability could allow a malicious actor to...