CVE-2025-6275
Last modified
CVE-2025-6275 is a low-severity vulnerability rated 3.3/10 on the CVSS scale. A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect "real world wasm programs". Therefore, this entry might get disputed as well in the future.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Webassembly | Wabt | < 1.0.37 |
References
- https://github.com/WebAssembly/wabt/issues/2614Exploit, Issue Tracking
- https://vuldb.com/?ctiid.313279Permissions Required, Third Party Advisory, VDB Entry
- https://vuldb.com/?id.313279Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.593017Third Party Advisory, VDB Entry
- https://github.com/WebAssembly/wabt/issues/2614Exploit, Issue Tracking
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-6275?
How severe is CVE-2025-6275?
How do I fix CVE-2025-6275?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-62744Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2025-62745Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2025-62746Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2025-62747Missing Authorization vulnerability in Aum Watcharapon Featu…5.3
- CVE-2025-62748Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2025-62749Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2025-62750Improper Neutralization of Input During Web Page Generation …5.9
- CVE-2025-62751Missing Authorization vulnerability in extendthemes Vireo vi…8.8
- CVE-2025-62752Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2025-62753Improper Control of Filename for Include/Require Statement i…7.5
- CVE-2025-62754Missing Authorization vulnerability in Kapil Paul Payment Ga…5.3
- CVE-2025-62755Missing Authorization vulnerability in GS Plugins GS Portfol…5.3
Are you affected by CVE-2025-6275?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST