CVE-2025-14957: 
NixOS vulnerability analysis and mitigation

CVE-2025-14957 is a null pointer dereference vulnerability in WebAssembly Binaryen up to and including version 125. It affects the IRBuilder::makeLocalGet, IRBuilder::makeLocalSet, and IRBuilder::makeLocalTee functions in src/wasm/wasm-ir-builder.cpp, triggered by passing an out-of-bounds Index argument when processing a malformed WebAssembly binary. The vulnerability was reported on December 4, 2025, patched on December 10, 2025, and publicly disclosed on December 19, 2025. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing bounds check (CWE-476: NULL Pointer Dereference) in the IRBuilder functions before calling wasm::Function::getLocalType(). When a malformed WebAssembly binary specifies a local variable index that exceeds the number of locals defined in the function, the code proceeds to call func->getLocalType(local) without validating the index, resulting in a read from a near-null address (observed at offset 0x3e8 from a null base pointer). The crash was confirmed to occur in Release builds with assertions disabled, meaning production deployments are affected. The fix, committed as 6fb2b917a79578ab44cf3b900a6da4c27251e0d4, adds explicit bounds checks (if (local >= func->getNumLocals())) in all three affected functions before the type lookup (Binaryen Issue #8090, Binaryen PR #8099, Fix Commit).

Successful exploitation causes a segmentation fault (SEGV) in the wasm-opt tool, resulting in a denial of service (application crash). There is no confidentiality or integrity impact — only availability is affected. The vulnerability is limited in scope to the local system and requires a low-privileged user to supply a crafted WebAssembly binary to the affected tool (Red Hat Advisory, Binaryen Issue #8090).

A proof-of-concept exploit (a malformed WebAssembly binary reproducer file) is publicly available via a GitHub repository linked in the original bug report (Binaryen Issue #8090). There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.014% (0.000140), reflecting very low probability of exploitation in the near term (Red Hat Advisory).

1. Craft a malformed WebAssembly binary: Create or obtain a .wasm file that specifies a local.get, local.set, or local.tee instruction with a local variable index exceeding the number of locals declared in the function. A public reproducer file (af1) is available at the reporter's GitHub repository.
2. Access the target system: Obtain local, low-privileged access to a system running a vulnerable version of Binaryen (≤ version 125).
3. Execute wasm-opt with the malformed binary: Run ./wasm-opt repro -o /dev/null, substituting repro with the crafted malformed binary file.
4. Trigger the crash: The WasmBinaryReader parses the malformed instruction, calls IRBuilder::makeLocalGet (or makeLocalSet/makeLocalTee) with the out-of-bounds index, which then calls func->getLocalType(local) without bounds checking, causing a SEGV and crashing the process (Binaryen Issue #8090).

• Process: Unexpected crash or segmentation fault of the wasm-opt process; core dump files generated by wasm-opt in the working directory.
• Logs: System logs (e.g., /var/log/syslog or journalctl) showing wasm-opt terminated with signal 11 (SIGSEGV); AddressSanitizer output referencing wasm::Function::getLocalType at wasm.cpp:1655 and wasm::IRBuilder::makeLocalGet at wasm-ir-builder.cpp:1415.
• File System: Presence of unexpected or unusually small .wasm binary files (e.g., ~55 bytes) submitted as input to wasm-opt (Binaryen Issue #8090).

Update WebAssembly Binaryen to a version newer than 125 that includes the fix commit 6fb2b917a79578ab44cf3b900a6da4c27251e0d4, merged on December 10, 2025. As a workaround, restrict local system access to trusted users only and avoid processing untrusted WebAssembly binaries with wasm-opt until the patch is applied. Implementing least-privilege access controls reduces the risk of exploitation by low-privileged accounts (Fix Commit, Red Hat Bugzilla).