CVE-2025-14957: WebAssembly Binaryen IRBuilder wasm-ir-builder.cpp makeLocalTee null pointer dereference
A vulnerability was identified in WebAssembly Binaryen up to 125. This affects the function IRBuilder::makeLocalGet/IRBuilder::makeLocalSet/IRBuilder::makeLocalTee of the file src/wasm/wasm-ir-builder.cpp of the component IRBuilder. Such manipulation of the argument Index leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is 6fb2b917a79578ab44cf3b900a6da4c27251e0d4. Applying a patch is advised to resolve this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14957?
CVE-2025-14957 has a medium severity rating due to the potential for local variable manipulation that may lead to unexpected behavior.
How do I fix CVE-2025-14957?
To fix CVE-2025-14957, update the WebAssembly Binaryen package to version 126 or later.
What components are affected by CVE-2025-14957?
CVE-2025-14957 affects the IRBuilder component within the WebAssembly Binaryen library.
What versions of Binaryen are vulnerable to CVE-2025-14957?
Binaryen versions up to and including 125 are vulnerable to CVE-2025-14957.
What impact does CVE-2025-14957 have on applications?
CVE-2025-14957 may allow attackers to manipulate local variables, potentially leading to application crashes or unpredictable behavior.