Medium
wabt — security advisory
A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCallDropKeepCount of the file wabt/src/interp/binary-reader-interp.cc. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
- Products
- wabt
- Affected versions
- 1.0.11-1, 1.0.12-1, 1.0.13-1, 1.0.13-1build1, 1.0.20-1, 1.0.24-1, 1.0.24-2, 1.0.25-1, 1.0.26-1, 1.0.27-1, 1.0.33-1, 1.0.34+dsfg2+~cs1.0.32-1ubuntu1, 1.0.34+dsfg2+~cs1.0.32-1ubuntu2, 1.0.34-1, 1.0.36+dfsg+~cs1.0.36-2ubuntu1, 1.0.36+dfsg+~cs1.0.36-2ubuntu4
- Fixed versions
- Not specified
- CVEs
- CVE-2025-2584
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:25 UTC · Revision 1
Source evidence
A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCallDropKeepCount of the file wabt/src/interp/binary-reader-interp.cc. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
osv:UBUNTU-CVE-2025-2584
wabt
Fixed versions: Not specified
wabt
Fixed versions: Not specified
wabt
Fixed versions: Not specified
wabt
Fixed versions: Not specified
wabt
Fixed versions: Not specified
wabt
Fixed versions: Not specified
Complete source record
{
"id": "5acc0f6c1b7635d66826682bf7c2b12394d3d06a9eb37625492d3270c3ac809a",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2025-2584",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2025-2584",
"summary": "A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCallDropKeepCount of the file wabt/src/interp/binary-reader-interp.cc. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.",
"evidence": "osv:UBUNTU-CVE-2025-2584",
"products": [
{
"name": {
"value": "wabt",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0.11-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.0.12-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.0.13-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.0.13-1build1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "wabt",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0.20-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.0.24-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.0.24-2",
"evidence": "/affected/1/versions"
},
{
"value": "1.0.25-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.0.26-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.0.27-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "wabt",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0.33-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.0.34-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.0.34+dsfg2+~cs1.0.32-1ubuntu1",
"evidence": "/affected/2/versions"
},
{
"value": "1.0.34+dsfg2+~cs1.0.32-1ubuntu2",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "wabt",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0.34+dsfg2+~cs1.0.32-1ubuntu2",
"evidence": "/affected/3/versions"
},
{
"value": "1.0.36+dfsg+~cs1.0.36-2ubuntu1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "wabt",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0.36+dfsg+~cs1.0.36-2ubuntu1",
"evidence": "/affected/4/versions"
},
{
"value": "1.0.36+dfsg+~cs1.0.36-2ubuntu4",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "wabt",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0.36+dfsg+~cs1.0.36-2ubuntu1",
"evidence": "/affected/5/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2025-2584",
"aliases": [
"UBUNTU-CVE-2025-2584"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wabt",
"purl": "pkg:deb/ubuntu/wabt?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.0.11-1",
"1.0.12-1",
"1.0.13-1",
"1.0.13-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-2584.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "wabt",
"binary_version": "1.0.13-1build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wabt",
"purl": "pkg:deb/ubuntu/wabt?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.0.20-1",
"1.0.24-1",
"1.0.24-2",
"1.0.25-1",
"1.0.26-1",
"1.0.27-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-2584.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "wabt",
"binary_version": "1.0.27-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wabt",
"purl": "pkg:deb/ubuntu/wabt?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.0.33-1",
"1.0.34-1",
"1.0.34+dsfg2+~cs1.0.32-1ubuntu1",
"1.0.34+dsfg2+~cs1.0.32-1ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-2584.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "wabt",
"binary_version": "1.0.34+dsfg2+~cs1.0.32-1ubuntu2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wabt",
"purl": "pkg:deb/ubuntu/wabt?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.0.34+dsfg2+~cs1.0.32-1ubuntu2",
"1.0.36+dfsg+~cs1.0.36-2ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-2584.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "wabt",
"binary_version": "1.0.36+dfsg+~cs1.0.36-2ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wabt",
"purl": "pkg:deb/ubuntu/wabt?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.0.36+dfsg+~cs1.0.36-2ubuntu1",
"1.0.36+dfsg+~cs1.0.36-2ubuntu4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-2584.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "wabt",
"binary_version": "1.0.36+dfsg+~cs1.0.36-2ubuntu4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wabt",
"purl": "pkg:deb/ubuntu/wabt?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.0.36+dfsg+~cs1.0.36-2ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-2584.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "wabt",
"binary_version": "1.0.36+dfsg+~cs1.0.36-2ubuntu1"
}
]
}
}
],
"modified": "2026-10-17T12:56:49.141147436Z",
"provider": "osv",
"upstream": [
"CVE-2025-2584"
],
"references": [
"https://ubuntu.com/security/CVE-2025-2584",
"https://www.cve.org/CVERecord?id=CVE-2025-2584",
"https://github.com/WebAssembly/wabt/issues/2557",
"https://github.com/WebAssembly/wabt/issues/2557#issue-2900405517",
"https://vuldb.com/?ctiid.300544",
"https://vuldb.com/?id.300544",
"https://vuldb.com/?submit.515406"
]
},
"related_cves": [
{
"value": "CVE-2025-2584",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/1/score"
},
"source_id": "core-osv",
"document_id": 356379,
"published_at": "2025-03-21T08:15:00+00:00"
}