Description
A vulnerability was identified in WebAssembly Binaryen up to 125. This affects the function IRBuilder::makeLocalGet/IRBuilder::makeLocalSet/IRBuilder::makeLocalTee of the file src/wasm/wasm-ir-builder.cpp of the component IRBuilder. Such manipulation of the argument Index leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is 6fb2b917a79578ab44cf3b900a6da4c27251e0d4. Applying a patch is advised to resolve this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WebAssembly | Binaryen | 125 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | binaryen | 130-2 | — |
| Debian 13 | binaryen | No fix yet | — |
| Debian 12 | binaryen | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | binaryen | No fix yet | — |
| Ubuntu 26.04 LTS | binaryen | No fix yet | — |
| Ubuntu 25.10 | binaryen | No fix yet | — |
| Ubuntu 24.04 LTS | binaryen | No fix yet | — |
| Ubuntu 22.04 LTS | binaryen | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | binaryen | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | binaryen | 133-1.1 | openSUSE-SU-2026:11915-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | binaryen | 129-r0 | — |
Advisories 1
- openSUSE-SU-2026:11915-1 binaryen-133-1.1 on GA media SUSE / openSUSE Security Updates · Sep 30, 2026
References
- VDB-337593 | WebAssembly Binaryen IRBuilder wasm-ir-builder.cpp makeLocalTee null pointer dereference vdb-entry technical-description
- VDB-337593 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #717317 | WebAssembly binaryen e7706b3 Memory Corruption third-party-advisory
- Submit #717319 | WebAssembly binaryen e7706b3 Memory Corruption (Duplicate) third-party-advisory
- https://github.com/WebAssembly/binaryen/issues/8090 issue-tracking
- https://github.com/WebAssembly/binaryen/pull/8099 issue-tracking
- https://github.com/oneafter/1204/blob/main/af1 exploit
- https://github.com/WebAssembly/binaryen/commit/6fb2b917a79578ab44cf3b900a6da4c27251e0d4 patch
- https://github.com/WebAssembly/binaryen/ product