CVE-2025-6274

A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been classified as problematic. Affected is the function OnDataCount of the file src/interp/binary-reader-interp.cc. The manipulation leads to resource consumption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect "real world wasm programs". Therefore, this entry might get disputed as well in the future.

• CWE-400
• CWE-404

• https://github.com/WebAssembly/wabt/issues/2598Exploit, Issue Tracking
• https://github.com/user-attachments/files/20191325/wabt_crash_4.txtExploit
• https://vuldb.com/?ctiid.313278Permissions Required, Third Party Advisory, VDB Entry
• https://vuldb.com/?id.313278Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.593016Third Party Advisory, VDB Entry
• https://github.com/WebAssembly/wabt/issues/2598Exploit, Issue Tracking

Published

Jun 19, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62734Cross-Site Request Forgery (CSRF) vulnerability in M.Code Me…4.3
• CVE-2025-62735Exposure of Sensitive System Information to an Unauthorized …5.3
• CVE-2025-62736Missing Authorization vulnerability in opicron Image Cleanup…4.3
• CVE-2025-62737Exposure of Sensitive System Information to an Unauthorized …5.3
• CVE-2025-62738Missing Authorization vulnerability in mmattax Formstack Onl…5.3
• CVE-2025-62739Cross-Site Request Forgery (CSRF) vulnerability in SaifuMak …6.5
• CVE-2025-62740Missing Authorization vulnerability in Mario Peshev WP-CRM S…5.3
• CVE-2025-62741Server-Side Request Forgery (SSRF) vulnerability in SmartDat…5.4
• CVE-2025-62742Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-62743Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-62744Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-62745Improper Neutralization of Input During Web Page Generation …6.5