CVE-2023-27119 Null dereference in n/a

Medium 5.5 Published 10 Mar 2023 Updated 28 Feb 2025

A segmentation fault in the WebAssembly binary toolkit allows attackers to cause a denial of service via crafted input.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-27119?

CVE-2023-27119 is a medium-severity vulnerability in n/a, published on 10 Mar 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild.

Which versions are affected by CVE-2023-27119?

1 open source package ship an affected version, including wabt. It affects 1 product.

Package	Affected	Fixed in
`wabt` PyPI	All versions to `1.0.29`	None

Products include Webassembly Wabt.

How do I fix CVE-2023-27119?

No fix has been published for CVE-2023-27119 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-27119 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27119 exists.

Sources

Also known as DEBIAN-CVE-2023-27119, GHSA-wx77-rf27-wqwf, PYSEC-2023-318, UBUNTU-CVE-2023-27119.