CVE-2024-28123

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Wasmi is an efficient and lightweight WebAssembly interpreter with a focus on constrained and embedded systems. In the WASMI Interpreter, an Out-of-bounds Buffer Write will arise if the host calls or resumes a Wasm function with more parameters than the default limit (128), as it will surpass the stack value. This doesn’t affect calls from Wasm to Wasm, only from host to Wasm. This vulnerability was patched in version 0.31.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Mar 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-281259.8FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed t CVE-2024-281266.1Cross-site scripting vulnerability exists in 0ch BBS Script ver.4.00. An arbitrary script may be executed on the web browser of the user acc CVE-2024-281277.5Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of priv CVE-2024-281286.1Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execu CVE-2024-28139.8A vulnerability was found in Tenda AC15 15.03.20_multi. It has been declared as critical. This vulnerability affects the function form_fast_CVE-2024-281307.5An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specia CVE-2024-281317.8EasyRange Ver 1.41 contains an issue with the executable file search path when displaying an extracted file on Explorer, which may lead to l CVE-2024-281324.4Exposure of Sensitive Information vulnerability exists in the GSLB container, which may allow an authenticated attacker with local access to CVE-2024-281337.8A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root privileges.CVE-2024-281347.0An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges o CVE-2024-281355.0A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app u CVE-2024-281367.8A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation usin