CVE-2025-6274 WebAssembly wabt binary-reader-interp.cc OnDataCount resource consumption

Medium 4.8 Published 19 Jun 2025 Updated 23 Jun 2025

A local attacker can cause resource consumption in the WebAssembly wabt library via the OnDataCount function, potentially leading to denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-6274?

CVE-2025-6274 is a medium-severity denial of service vulnerability in WebAssembly wabt, published on 19 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been classified as problematic. Affected is the function OnDataCount of the file src/interp/binary-reader-interp.cc. The manipulation leads to resource consumption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect "real world wasm programs". Therefore, this entry might get disputed as well in the future.

Weakness: CWE-404, CWE-400

Which versions are affected by CVE-2025-6274?

It affects 1 product.

Products include Webassembly Wabt.

How do I fix CVE-2025-6274?

No fix has been published for CVE-2025-6274 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-6274 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-6274 exists.

Sources

Also known as DEBIAN-CVE-2025-6274, GHSA-2467-jr62-j23f, UBUNTU-CVE-2025-6274.