Executive brief
A memory management vulnerability exists in pywasm3, a Python wrapper for the Wasm3 WebAssembly runtime. This runtime is used to execute WebAssembly code in various environments, including embedded systems and cloud applications. An attacker with local access could provide a specially crafted WebAssembly file that causes the application to crash, potentially leading to a denial-of-service condition.
Technical details
An out-of-bounds (OOB) write vulnerability exists in the MarkSlotAllocated function within source/m3_compile.c of wasm3 and its Python wrapper pywasm3. The issue occurs during the compilation phase of WebAssembly modules when the runtime improperly restricts memory buffer operations while marking slots as allocated. A local attacker can exploit this by providing a malicious WebAssembly binary, triggering a segmentation fault (SEGV) and resulting in a denial-of-service. The vulnerability was identified via fuzzing and affects version 0.5.0; as of the advisory date, no official patch has been confirmed in the provided text.
Affected products
- wasm3 project pywasm3 <= 0.5.0
- wasm3 project wasm3 0.5.0
Timeline
- 2025-03-29: disclosed: Issue reported on GitHub repository
- 2025-06-19: advisory: GitHub and NVD advisories published