CVE-2024-28123CWE-787

Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters

High · published March 8, 2024

CVSS v3.1
7.3
EPSS
1%
Percentile
56.0
In the wild
Unconfirmed
What it is

Wasmi is an efficient and lightweight WebAssembly interpreter with a focus on constrained and embedded systems. In the WASMI Interpreter, an Out-of-bounds Buffer Write will arise if the host calls or resumes a Wasm function with more parameters than the default limit (128), as it will surpass the stack value. This doesn’t affect calls from Wasm to Wasm, only from host to Wasm. This vulnerability was patched in version 0.31.1.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00798 · 56.0th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2024-03-08T21:29Z
EPSS history
Timeline
  • 08 MAR 21:29Z
    Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters
    cvelistv5