CVE-2025-2368: 
NixOS vulnerability analysis and mitigation

A critical heap-based buffer overflow vulnerability (CVE-2025-2368) was discovered in WebAssembly wabt version 1.0.36. The vulnerability affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport in the file wabt/src/interp/binary-reader-interp.cc of the Malformed File Handler component. The vulnerability was disclosed on March 17, 2025 (NVD).

The vulnerability is classified as a heap-based buffer overflow (CWE-122) and improper restriction of operations within memory buffer bounds (CWE-119). The issue occurs when processing certain malformed files and calls the function FuncType::Clone() in the first case of the switch statement, leading to an out-of-bounds read and potential application crash. The vulnerability has a CVSS v3.1 base score of 6.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L (GitHub Issue).

The vulnerability allows remote attackers to cause a heap-based buffer overflow, which can lead to application crashes and potential arbitrary code execution. The attack can be initiated remotely and may result in unauthorized access to memory locations (GitHub Issue).

It is recommended to apply a patch to fix this issue. The development team is working on making ReadBinaryOptions more strict across readers to prevent such vulnerabilities, as discussed in pull request #2541 (GitHub PR).