WebAssembly tooling and runtimes, including the Binaryen compiler, WABT (WebAssembly Binary Toolkit), and related reference implementations, form a niche but strategically important layer in the modern software stack, sitting between high-level languages and execution environments. The vulnerability surface concentrates in memory-safety and bounds-checking weaknesses—reachable assertions, out-of-bounds reads and writes, NULL pointer dereferences, and improper buffer restrictions—that are characteristic of low-level compiler and runtime code handling untrusted binary formats. These flaws span toolchains and runtimes that are embedded in browsers, server-side WebAssembly hosts, and build pipelines, meaning individual disclosures can affect a broad downstream ecosystem despite the vendor's narrow direct product line. Defenders tracking WebAssembly adoption should monitor this vendor's advisories for memory-corruption and validation gaps that could impact any system compiling or executing WebAssembly modules. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Webassembly over time
Signals from CVEs in this vendor scope (45 CVEs).
45 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-8257MEDIUM A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of the file src/wasm/wasm-ir-builder.cpp of the component BrOn P | May 11, 2026 | 5.5 | 27 | NO | NO |
CVE-2025-15412HIGH A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompil | Jan 1, 2026 | 7.8 | 25 | NO | NO |
CVE-2025-15411HIGH A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the | Jan 1, 2026 | 7.8 | 25 | NO | NO |
CVE-2025-14956HIGH A vulnerability was determined in WebAssembly Binaryen up to 125. Affected by this issue is the function WasmBinaryReader::readExport of the file src/wasm/wasm-binary.cpp. This man | Dec 19, 2025 | 7.1 | 25 | NO | NO |
CVE-2025-2368HIGH A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport o | Mar 17, 2025 | 8.8 | 25 | NO | NO |
CVE-2022-43281HIGH wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<wabt::Type>>::size() at /bits/stl_vector.h. | Oct 28, 2022 | 7.8 | 25 | NO | NO |
CVE-2023-27117HIGH WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator. | Mar 10, 2023 | 7.8 | 24 | NO | NO |
CVE-2022-43280HIGH wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDropKeepCount. | Oct 28, 2022 | 7.1 | 24 | NO | NO |
CVE-2023-31670HIGH An issue in wasm2c 1.0.32, wasm2wat 1.0.32, wasm-decompile 1.0.32, and wasm-validate 1.0.32 allows attackers to cause a Denial of Service (DoS) via running a crafted binary. | May 23, 2023 | 7.5 | 23 | NO | NO |
CVE-2019-15759MEDIUM An issue was discovered in Binaryen 1.38.32. Two visitors in ir/ExpressionManipulator.cpp can lead to a NULL pointer dereference in wasm::LocalSet::finalize in wasm/wasm.cpp. A cra | Aug 29, 2019 | 6.5 | 22 | NO | NO |
Signals from CVEs in this vendor scope (45 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Webassembly.
Media articles that mention a CVE ID that affects a product developed by Webassembly — matched by CVE ID, not by vendor name.