Medium severity · published Dec 19, 2025
CVE-2025-14957
WebAssembly Binaryen IRBuilder wasm-ir-builder.cpp makeLocalTee null pointer dereference
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was identified in WebAssembly Binaryen up to 125. This affects the function IRBuilder::makeLocalGet/IRBuilder::makeLocalSet/IRBuilder::makeLocalTee of the file src/wasm/wasm-ir-builder.cpp of the component IRBuilder. Such manipulation of the argument Index leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is 6fb2b917a79578ab44cf3b900a6da4c27251e0d4. Applying a patch is advised to resolve this issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BI
Binaryen · WebAssembly
125 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14957
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14957
github.com
https://github.com/WebAssembly/binaryen/
Patch
https://github.com/WebAssembly/binaryen/commit/6fb2b917a79578ab44cf3b900a6da4c27251e0d4
Exploit
https://github.com/WebAssembly/binaryen/issues/8090
Issue Tracking
https://github.com/WebAssembly/binaryen/pull/8099
Not Applicable
https://github.com/oneafter/1204/blob/main/af1
Permissions Required
https://vuldb.com/?ctiid.337593
More from Binaryen
7.5
CVE-2021-45290
A Denial of Service vulnerability exits in Binaryen 103 due to an assertion abort in wasm::handle_unreachable
7.1
CVE-2025-14956
WebAssembly Binaryen wasm-binary.cpp readExport heap-based overflow
6.5
CVE-2020-18382
Heap-buffer-overflow in /src/wasm/wasm-binary.cpp in wasm::WasmBinaryBuilder::visitBlock(wasm::Block*) in Binaryen 1.38.26
6.5
CVE-2020-18378
A NULL pointer dereference was discovered in SExpressionWasmBuilder::makeBlock in wasm/wasm-s-parser.c in Binaryen 1.38.26
6.5
CVE-2019-15759
An issue was discovered in Binaryen 1.38.32