Quick answers
- Is CVE-2025-6272 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-6272 being exploited in the wild.
- How severe is CVE-2025-6272?
- Medium severity, with a CVSS score of 4, published 19 June 2025.
- Which products and versions are affected?
- pywasm3 (PyPI) <= 0.5.0, ECOSYSTEM:introduced=0,last_affected=0.5.0.
- Is there a fix for CVE-2025-6272?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-6272 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2025-6272?
- Check whether you run pywasm3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An out-of-bounds (OOB) write vulnerability exists in the MarkSlotAllocated function within source/m3_compile.c of wasm3 and its Python wrapper pywasm3. The issue occurs during the compilation phase of WebAssembly modules when the runtime improperly restricts memory buffer operations while marking slots as allocated. A local attacker can exploit this by providing a malicious WebAssembly binary, triggering a segmentation fault (SEGV) and resulting in a denial-of-service. The vulnerability was identified via fuzzing and affects version 0.5.0; as of the advisory date, no official patch has been confirmed in the provided text.
Affected products
- wasm3 project pywasm3 <= 0.5.0
- wasm3 project wasm3 0.5.0
Identifiers
- CVE-2025-6272
- GHSA-rrmw-gv85-w824
- PYSEC-2025-186
Timeline
- 2025-03-29: disclosed: Issue reported on GitHub repository
- 2025-06-19: advisory: GitHub and NVD advisories published