CVE-2025-14957 WebAssembly Binaryen IRBuilder wasm-ir-builder.cpp makeLocalTee null pointer dereference

Medium 4.8 Published 19 Dec 2025 Updated 24 Feb 2026

A null pointer dereference in WebAssembly Binaryen's IRBuilder allows local attackers to cause a denial of service via crafted input.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2025-14957?

CVE-2025-14957 is a medium-severity vulnerability in WebAssembly Binaryen, published on 19 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability was identified in WebAssembly Binaryen up to 125. This affects the function IRBuilder::makeLocalGet/IRBuilder::makeLocalSet/IRBuilder::makeLocalTee of the file src/wasm/wasm-ir-builder.cpp of the component IRBuilder. Such manipulation of the argument Index leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is 6fb2b917a79578ab44cf3b900a6da4c27251e0d4. Applying a patch is advised to resolve this issue.

Weakness: CWE-476, CWE-404

Which versions are affected by CVE-2025-14957?

It affects 1 product.

Products include Webassembly Binaryen.

How do I fix CVE-2025-14957?

Apply the vendor's patch.

Is CVE-2025-14957 being exploited?

There is no known exploitation of CVE-2025-14957 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2025-14957, GHSA-3h23-rfwm-gcx3, JLSEC-2026-1093, UBUNTU-CVE-2025-14957.