CVE-2025-6273 WebAssembly wabt binary-reader-objdump.cc LogOpcode assertion

What is CVE-2025-6273?

CVE-2025-6273 is a medium-severity denial of service vulnerability in WebAssembly wabt, published on 19 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability was found in WebAssembly wabt up to 1.0.37 and classified as problematic. This issue affects the function LogOpcode of the file src/binary-reader-objdump.cc. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains that this issue might not affect "real world wasm programs".

Weakness: CWE-617

Which versions are affected by CVE-2025-6273?

It affects 1 product.

Products include Webassembly Wabt.

How do I fix CVE-2025-6273?

No fix has been published for CVE-2025-6273 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-6273 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-6273 exists.

Other vulnerabilities in WebAssembly wabt

• CVE-2022-43280 Memory corruption in n/a High 7.1
• CVE-2022-43282 Memory corruption in n/a High 7.1
• CVE-2023-27119 Null dereference in n/a Medium 5.5
• CVE-2022-43283 Denial of service in n/a Medium 5.5
• CVE-2025-2368 WebAssembly wabt Malformed File binary-reader-interp.cc OnExport heap-based overflow Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2025-6273, GHSA-frwp-9m3q-pjc8, UBUNTU-CVE-2025-6273.