CVE-2024-28123 json
Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters
published 2024-03-07 2 y ago modified 2026-09-10 1 mo ago also GHSA-75jp-vq8x-h4cq , EUVD-2024-0852
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
Wasmi is an efficient and lightweight WebAssembly interpreter with a focus on constrained and embedded systems. In the WASMI Interpreter, an Out-of-bounds Buffer Write will arise if the host calls or resumes a Wasm function with more parameters than the default limit (128), as it will surpass the stack value. This doesn’t affect calls from Wasm to Wasm, only from host to Wasm. This vulnerability was patched in version 0.31.1.
Patch / fix
- crates.io wasmi 0.31.1
- wasmi-labs wasmi 0.31.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.80% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | wasmi | >=0.15.0, <0.31.1 |
0.31.1 |
Affected products
- wasmi-labs wasmi
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
github.com
/wasmi-labs/wasmi/commit/f7b3200e9f3dc9e2cbca966cb255c228453c792f
web, patch
-
github.com
/wasmi-labs/wasmi/security/advisories/GHSA-75jp-vq8x-h4cq
web, vendor-advisory
-
github.com
/wasmi-labs/wasmi/releases/tag/v0.31.1
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2024-28123
advisory
-
github.com
/wasmi-labs/wasmi
package
Sources
- CVE List CVE-2024-28123
- GitHub Advisory GHSA-75jp-vq8x-h4cq
- NVD CVE-2024-28123
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.