CVE-2020-18378

A NULL pointer dereference was discovered in SExpressionWasmBuilder::makeBlock in wasm/wasm-s-parser.c in Binaryen 1.38.26. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-as.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.61% chance of exploitation in the next 30 days, 47th percentile

Published

2023-08-22

Updated

2024-10-03

Proof-of-concept exploits (1)

• WebAssembly/binaryen/issues/1900

References

• CVE Record
• NVD entry

Related

• CVE-2019-15758
• CVE-2019-15759
• CVE-2019-7151
• CVE-2019-7152
• CVE-2019-7153
• CVE-2019-7154