CVE-2024-28123
HIGHwasmi 0.15.0-0.31.0 - Out-of-bounds Write via Host Function Call
Title source: llmDescription
Wasmi is an efficient and lightweight WebAssembly interpreter with a focus on constrained and embedded systems. In the WASMI Interpreter, an Out-of-bounds Buffer Write will arise if the host calls or resumes a Wasm function with more parameters than the default limit (128), as it will surpass the stack value. This doesn’t affect calls from Wasm to Wasm, only from host to Wasm. This vulnerability was patched in version 0.31.1.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://github.com/wasmi-labs/wasmi/security/advisories/GHSA-75jp-vq8x-h4cq
Patch x_refsource_misc
https://github.com/wasmi-labs/wasmi/commit/f7b3200e9f3dc9e2cbca966cb255c228453c792f
Release Notes x_refsource_misc
https://github.com/wasmi-labs/wasmi/releases/tag/v0.31.1
Scores
CVSS v3
7.3
EPSS
0.0080
EPSS Percentile
51.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-787
Status
published
Products (2)
crates.io/wasmi
0.15.0 - 0.31.1crates.io
wasmi-labs/wasmi
0.15.0 - 0.31.1
Published
Mar 21, 2024
Tracked Since
Feb 18, 2026