CVE-2025-6272

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

A vulnerability has been found in wasm3 0.5.0 and classified as problematic. This vulnerability affects the function MarkSlotAllocated of the file source/m3_compile.c. The manipulation leads to out-of-bounds write. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-119 CWE-787

Affected software

Vendor	Product	Versions
n/a	wasm3	0.5.0

References

https://github.com/user-attachments/files/19516600/wasm3_crash.txtExploit
https://github.com/wasm3/wasm3/issues/531Exploit, Issue Tracking
https://vuldb.com/?ctiid.313276Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.313276Third Party Advisory, VDB Entry
https://vuldb.com/?submit.593008Third Party Advisory, VDB Entry
https://github.com/wasm3/wasm3/issues/531Exploit, Issue Tracking

Timeline

Published: Jun 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-627206.5LinkAce is a self-hosted archive to collect website links. Versions 2.3.1 and below allow any authenticated user to export the entire databa CVE-2025-627216.5LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, authenticated RSS feed endpoints in the FeedControll CVE-2025-627225.4LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, the social media sharing functionality contains a St CVE-2025-627234.3FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.23.2, any authenticated user can create sessions an CVE-2025-627244.3Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" (TOCTOU) at CVE-2025-627258.9Docker Compose trusts the path information embedded in remote OCI compose artifacts. When a layer includes the annotations com.docker.compos CVE-2025-627268.8n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component CVE-2025-627277.5Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can CVE-2025-627285.4SQL injection vulnerability in Hive Metastore Server (HMS) when processing delete column statistics requests via the Thrift APIs. The vulner CVE-2025-627295.4SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website CVE-2025-62733.3A vulnerability was found in WebAssembly wabt up to 1.0.37 and classified as problematic. This issue affects the function LogOpcode of the f CVE-2025-627308.8SOPlanning is vulnerable to Privilege Escalation in user management tab. Users with user_manage_team role are allowed to modify permissions