PT-2025-38054

Name of the Vulnerable Software and Affected Versions: WebAssembly Micro Runtime WAMR versions prior to 2.4.2 Description: WebAssembly Micro Runtime WAMR is a lightweight standalone WebAssembly Wasm runtime. When running in LLVM-JIT mode, the runtime cannot exit normally when executing WebAssembl...

Exploring and Exploiting the Resource Isolation Attack Surface of WebAssembly Containers

Recently, the WebAssembly or Wasm technology has been rapidly evolving, with many runtimes actively under development, providing cross-platform secure sandboxes for Wasm modules to run as portable containers. Compared with Docker, which isolates applications at the operating system level, Wasm...

Embedded Malicious Code

Overview @duckdb/duckdb-wasm is an in-process analytical SQL database for the browser. It is powered by WebAssembly, speaks Arrow fluently, reads Parquet, CSV and JSON files backed by Filesystem APIs or HTTP requests and has been tested with Chrome, Firefox, Safari and Node.js. Affected versions ...

Introducing wasi-grpc for Spin

...

OESA-2025-2099 thunderbird security update

Security Fixes: On 64-bit platforms, IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack, while Baseline-JIT read the entire 64 bits. This vulnerability affects Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13,...

WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified

...

WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild.

...

The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128 and Thunderbird < 128.

...

Linux Distros Unpatched Vulnerability : CVE-2023-27115

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::catcomputesize. CVE-2023-27115 Note that Nessus relies on the presenc...

Linux Distros Unpatched Vulnerability : CVE-2025-3122

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability classified as problematic was found in WebAssembly wabt 1.0.36. Affected by this vulnerability is the function...

Linux Distros Unpatched Vulnerability : CVE-2018-4222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTun...

Linux Distros Unpatched Vulnerability : CVE-2023-46331

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange, which lead to segmentation fault. CVE-2023-46331 Note that Nessus relie...

Linux Distros Unpatched Vulnerability : CVE-2024-30266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest...

The WASM Cloak: Evaluating Browser Fingerprinting Defenses under WebAssembly Based Obfuscation

Browser fingerprinting defenses have historically focused on detecting JavaScriptJS-based tracking techniques. However, the widespread adoption of WebAssembly WASM introduces a potential blind spot, as adversaries can convert JS to WASM's low-level binary format to obfuscate malicious logic. This...

Linux Distros Unpatched Vulnerability : CVE-2023-46332

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop, which lead to segmentation fault. CVE-2023-46332 Note that Nessus relies on...

Linux Distros Unpatched Vulnerability : CVE-2023-27117

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator. CVE-2023-27117 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2018-11378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The wasmdis function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file. CVE-2018-11378 Note that Nessus relies o...

Linux Distros Unpatched Vulnerability : CVE-2025-6275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of...

Linux Distros Unpatched Vulnerability : CVE-2017-7716

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The readu32leb128 function in libr/util/uleb128.c in radare2 1.3.0 allows remote attackers to cause a denial of service heap-based buffer over-read and...

Linux Distros Unpatched Vulnerability : CVE-2019-7153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference was discovered in wasm::WasmBinaryBuilder::processFunctions in wasm/wasm- binary.cpp when calling...