Binaryen
by Webassembly
Source repositories
CVEs (25)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-14956 | Med | 0.27 | 5.3 | 0.00 | Dec 19, 2025 | A vulnerability was determined in WebAssembly Binaryen up to 125. Affected by this issue is the function WasmBinaryReader::readExport of the file src/wasm/wasm-binary.cpp. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host.… | ||
| CVE-2026-8257 | Low | 0.14 | 3.3 | 0.00 | May 11, 2026 | A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of the file src/wasm/wasm-ir-builder.cpp of the component BrOn Parser. Performing a manipulation results in reachable assertion. The attack needs to be approached… | ||
| CVE-2025-14957 | Low | 0.14 | 3.3 | 0.00 | Dec 19, 2025 | A vulnerability was identified in WebAssembly Binaryen up to 125. This affects the function IRBuilder::makeLocalGet/IRBuilder::makeLocalSet/IRBuilder::makeLocalTee of the file src/wasm/wasm-ir-builder.cpp of the component IRBuilder. Such manipulation of the argument Index leads… | ||
| CVE-2020-18378 | 0.00 | — | 0.01 | Aug 22, 2023 | A NULL pointer dereference was discovered in SExpressionWasmBuilder::makeBlock in wasm/wasm-s-parser.c in Binaryen 1.38.26. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-as. | |||
| CVE-2020-18382 | 0.00 | — | 0.01 | Aug 22, 2023 | Heap-buffer-overflow in /src/wasm/wasm-binary.cpp in wasm::WasmBinaryBuilder::visitBlock(wasm::Block*) in Binaryen 1.38.26. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-opt. | |||
| CVE-2021-46055 | 0.00 | — | 0.01 | Jan 7, 2022 | A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*). | |||
| CVE-2021-46054 | 0.00 | — | 0.01 | Jan 7, 2022 | A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*). | |||
| CVE-2021-46053 | 0.00 | — | 0.01 | Jan 7, 2022 | A Denial of Service vulnerability exists in Binaryen 103. The program terminates with signal SIGKILL. | |||
| CVE-2021-46052 | 0.00 | — | 0.01 | Jan 7, 2022 | A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::Tuple::validate. | |||
| CVE-2021-46050 | 0.00 | — | 0.01 | Jan 7, 2022 | A Stack Overflow vulnerability exists in Binaryen 103 via the printf_common function. | |||
| CVE-2021-46048 | 0.00 | — | 0.01 | Jan 7, 2022 | A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::readFunctions. | |||
| CVE-2021-45293 | 0.00 | — | 0.01 | Dec 21, 2021 | A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet. | |||
| CVE-2021-45290 | 0.00 | — | 0.01 | Dec 21, 2021 | A Denial of Service vulnerability exits in Binaryen 103 due to an assertion abort in wasm::handle_unreachable. | |||
| CVE-2019-15758 | 0.00 | — | 0.01 | Aug 29, 2019 | An issue was discovered in Binaryen 1.38.32. Missing validation rules in asmjs/asmangle.cpp can lead to an Assertion Failure at wasm/wasm.cpp in wasm::asmangle. A crafted input can cause denial-of-service, as demonstrated by wasm2js. | |||
| CVE-2019-15759 | 0.00 | — | 0.01 | Aug 29, 2019 | An issue was discovered in Binaryen 1.38.32. Two visitors in ir/ExpressionManipulator.cpp can lead to a NULL pointer dereference in wasm::LocalSet::finalize in wasm/wasm.cpp. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js. | |||
| CVE-2019-7700 | 0.00 | — | 0.01 | Feb 10, 2019 | A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-merge. | |||
| CVE-2019-7702 | 0.00 | — | 0.01 | Feb 10, 2019 | A NULL pointer dereference was discovered in wasm::SExpressionWasmBuilder::parseExpression in wasm-s-parser.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-as. | |||
| CVE-2019-7701 | 0.00 | — | 0.01 | Feb 10, 2019 | A heap-based buffer over-read was discovered in wasm::SExpressionParser::skipWhitespace() in wasm-s-parser.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm2js. | |||
| CVE-2019-7703 | 0.00 | — | 0.01 | Feb 10, 2019 | In Binaryen 1.38.22, there is a use-after-free problem in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp. Remote attackers could leverage this vulnerability to cause a denial-of-service via a wasm file, as demonstrated by wasm-merge. | |||
| CVE-2019-7704 | 0.00 | — | 0.01 | Feb 10, 2019 | wasm::WasmBinaryBuilder::readUserSection in wasm-binary.cpp in Binaryen 1.38.22 triggers an attempt at excessive memory allocation, as demonstrated by wasm-merge and wasm-opt. |
- risk 0.27cvss 5.3epss 0.00
A vulnerability was determined in WebAssembly Binaryen up to 125. Affected by this issue is the function WasmBinaryReader::readExport of the file src/wasm/wasm-binary.cpp. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host.…
- risk 0.14cvss 3.3epss 0.00
A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of the file src/wasm/wasm-ir-builder.cpp of the component BrOn Parser. Performing a manipulation results in reachable assertion. The attack needs to be approached…
- risk 0.14cvss 3.3epss 0.00
A vulnerability was identified in WebAssembly Binaryen up to 125. This affects the function IRBuilder::makeLocalGet/IRBuilder::makeLocalSet/IRBuilder::makeLocalTee of the file src/wasm/wasm-ir-builder.cpp of the component IRBuilder. Such manipulation of the argument Index leads…
- CVE-2020-18378Aug 22, 2023risk 0.00cvss —epss 0.01
A NULL pointer dereference was discovered in SExpressionWasmBuilder::makeBlock in wasm/wasm-s-parser.c in Binaryen 1.38.26. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-as.
- CVE-2020-18382Aug 22, 2023risk 0.00cvss —epss 0.01
Heap-buffer-overflow in /src/wasm/wasm-binary.cpp in wasm::WasmBinaryBuilder::visitBlock(wasm::Block*) in Binaryen 1.38.26. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-opt.
- CVE-2021-46055Jan 7, 2022risk 0.00cvss —epss 0.01
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
- CVE-2021-46054Jan 7, 2022risk 0.00cvss —epss 0.01
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
- CVE-2021-46053Jan 7, 2022risk 0.00cvss —epss 0.01
A Denial of Service vulnerability exists in Binaryen 103. The program terminates with signal SIGKILL.
- CVE-2021-46052Jan 7, 2022risk 0.00cvss —epss 0.01
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::Tuple::validate.
- CVE-2021-46050Jan 7, 2022risk 0.00cvss —epss 0.01
A Stack Overflow vulnerability exists in Binaryen 103 via the printf_common function.
- CVE-2021-46048Jan 7, 2022risk 0.00cvss —epss 0.01
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::readFunctions.
- CVE-2021-45293Dec 21, 2021risk 0.00cvss —epss 0.01
A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet.
- CVE-2021-45290Dec 21, 2021risk 0.00cvss —epss 0.01
A Denial of Service vulnerability exits in Binaryen 103 due to an assertion abort in wasm::handle_unreachable.
- CVE-2019-15758Aug 29, 2019risk 0.00cvss —epss 0.01
An issue was discovered in Binaryen 1.38.32. Missing validation rules in asmjs/asmangle.cpp can lead to an Assertion Failure at wasm/wasm.cpp in wasm::asmangle. A crafted input can cause denial-of-service, as demonstrated by wasm2js.
- CVE-2019-15759Aug 29, 2019risk 0.00cvss —epss 0.01
An issue was discovered in Binaryen 1.38.32. Two visitors in ir/ExpressionManipulator.cpp can lead to a NULL pointer dereference in wasm::LocalSet::finalize in wasm/wasm.cpp. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js.
- CVE-2019-7700Feb 10, 2019risk 0.00cvss —epss 0.01
A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-merge.
- CVE-2019-7702Feb 10, 2019risk 0.00cvss —epss 0.01
A NULL pointer dereference was discovered in wasm::SExpressionWasmBuilder::parseExpression in wasm-s-parser.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-as.
- CVE-2019-7701Feb 10, 2019risk 0.00cvss —epss 0.01
A heap-based buffer over-read was discovered in wasm::SExpressionParser::skipWhitespace() in wasm-s-parser.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm2js.
- CVE-2019-7703Feb 10, 2019risk 0.00cvss —epss 0.01
In Binaryen 1.38.22, there is a use-after-free problem in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp. Remote attackers could leverage this vulnerability to cause a denial-of-service via a wasm file, as demonstrated by wasm-merge.
- CVE-2019-7704Feb 10, 2019risk 0.00cvss —epss 0.01
wasm::WasmBinaryBuilder::readUserSection in wasm-binary.cpp in Binaryen 1.38.22 triggers an attempt at excessive memory allocation, as demonstrated by wasm-merge and wasm-opt.
Page 1 of 2