CVE-2023-27116 Denial of service in n/a

Medium 5.5 Published 10 Mar 2023 Updated 28 Feb 2025

An abort in CWriter::MangleType allows attackers to cause a denial of service in applications using the WebAssembly library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-27116?

CVE-2023-27116 is a medium-severity denial of service vulnerability in n/a, published on 10 Mar 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

WebAssembly v1.0.29 discovered to contain an abort in CWriter::MangleType.

Which versions are affected by CVE-2023-27116?

It affects 1 product.

Products include Webassembly Webassembly.

How do I fix CVE-2023-27116?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-27116 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27116 exists.

Sources

Also known as DEBIAN-CVE-2023-27116, GHSA-whc2-2q67-xmxj, UBUNTU-CVE-2023-27116.