CVE-2025-14956: 
NixOS vulnerability analysis and mitigation

CVE-2025-14956 is a heap-based buffer overflow vulnerability in WebAssembly Binaryen versions up to and including 125, affecting the WasmBinaryReader::readExpression function in src/wasm/wasm-binary.cpp. The flaw was discovered and reported on December 4, 2025, with the CVE published on December 19, 2025. It affects the wasm-opt tool when parsing malformed WebAssembly binaries, and a public proof-of-concept exploit has been disclosed. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) with a local attack vector (Red Hat Advisory, VulDB).

The root cause is an improper bounds check in the WasmBinaryReader::readExpression() function (CWE-122: Heap-based Buffer Overflow; CWE-125: Out-of-bounds Read). When parsing a malformed WebAssembly binary, the parser enters a while loop that reads bytes from the input buffer without first verifying that the end of input has not been reached — specifically, the original code checked input[pos] != BinaryConsts::End without a preceding more() guard, allowing a read of 1 byte past the end of a heap-allocated buffer. The crash is triggered via WasmBinaryReader::readDataSegments() → readExpression() at wasm-binary.cpp:4736, as confirmed by AddressSanitizer output. The fix (commit 4f52bff) adds a more() check before each loop iteration and throws an error on unexpected EOF (GitHub Issue, GitHub Commit).

Successful exploitation can cause a crash of the wasm-opt process (denial of service) and may expose heap memory contents, impacting confidentiality and availability. Because the overflow occurs on the heap, there is a theoretical risk of memory corruption that could lead to arbitrary code execution in the context of the process running Binaryen tools, though this requires local access with low privileges. The integrity impact is assessed as none in the primary CVSS v3.1 scoring, but memory corruption scenarios could affect data integrity in adjacent heap regions (Red Hat Advisory, GitHub Issue).

A public proof-of-concept exploit (a malformed WebAssembly binary reproducer file) has been disclosed on GitHub by the reporter (GitHub Issue, PoC File). There is no confirmed evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (VulDB).

1. Prepare the malformed binary: Craft or obtain a malformed WebAssembly binary (.wasm) file that contains a truncated Data Segment — specifically, one where the expression within the segment ends at the exact boundary of the input buffer, causing the parser to attempt a read past the end. A public reproducer file is available at the reporter's GitHub repository.
2. Identify a vulnerable installation: Confirm the target system is running Binaryen version ≤ 125 (e.g., check wasm-opt --version).
3. Trigger the vulnerability: Execute wasm-opt <malformed.wasm> -o /dev/null on the target system. The wasm-opt tool will invoke ModuleReader::readBinary() → WasmBinaryReader::read() → readDataSegments() → readExpression(), where the missing EOF check causes a 1-byte out-of-bounds heap read.
4. Observe the result: Without ASAN, the process may crash (SIGSEGV or abort) or silently read adjacent heap memory. With ASAN enabled, the heap-buffer-overflow is reported at wasm-binary.cpp:4736. Depending on heap layout, an attacker may attempt to leverage the memory corruption for further exploitation (GitHub Issue, GitHub Commit).

• Process: Unexpected crashes or aborts of wasm-opt or other Binaryen tools (e.g., wasm-dis, wasm-merge) when processing untrusted .wasm files; SIGSEGV or abort signals from Binaryen processes.
• Logs: AddressSanitizer output referencing heap-buffer-overflow at wasm-binary.cpp:4736 in WasmBinaryReader::readExpression(); core dump files generated by wasm-opt in the working directory.
• File System: Presence of small, malformed .wasm files (e.g., ~272 bytes) with truncated Data Segments submitted to Binaryen tooling; unexpected core dump files (core.*) in directories where Binaryen tools are executed.
• Network: If Binaryen tools are exposed as part of a web service or CI/CD pipeline, unusual uploads of malformed .wasm files from untrusted sources to the processing endpoint.

The fix is included in commit 4f52bff8c4075b5630422f902dd92a0af2c9f398, merged into the Binaryen main branch on December 9, 2025; users should upgrade to any Binaryen release that includes this commit (versions after 125) (GitHub Commit, GitHub PR). As a workaround for systems that cannot immediately patch, restrict local access to Binaryen tools and avoid processing untrusted or externally supplied .wasm files. Additionally, running Binaryen tools in sandboxed environments (e.g., containers with limited privileges) can reduce the impact of exploitation (Red Hat Advisory).

Red Hat tracked the issue via Bugzilla (Bug 2423909) and assigned it medium priority/severity, indicating it is on their radar for downstream package updates (Red Hat Bugzilla). The Binaryen maintainer (kripken) responded promptly, merging the fix within 5 days of the bug report. Fedora issued an update for the binaryen package to address this CVE, and the issue received coverage from Linux security news outlets and community forums (Linux Security). Overall community reaction has been measured, consistent with a locally-exploitable, low-EPSS vulnerability with a straightforward patch.