CVE-2019-7703

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-02-10 · updated 2026-06-17
Weakness: CWE-416

Description

In Binaryen 1.38.22, there is a use-after-free problem in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp. Remote attackers could leverage this vulnerability to cause a denial-of-service via a wasm file, as demonstrated by wasm-merge.

Affected products

WebAssembly Binaryen: before 64 — fixed in 64

How to fix

Upgrade to a fixed version: WebAssembly Binaryen 64. Check the vendor advisory for mitigations.

References

https://github.com/WebAssembly/binaryen/issues/1865
https://github.com/WebAssembly/binaryen/issues/1865

Get alerted when CVE-2019-7703 or the next vulnerability affects your stack