{"id":"CVE-2017-7854","details":"The consume_init_expr function in wasm.c in radare2 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted Web Assembly file.","modified":"2026-08-07T14:53:37.631634Z","published":"2017-04-13T16:59:01.317Z","references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/97648"},{"type":"FIX","url":"https://github.com/radare/radare2/commit/d2632f6483a3ceb5d8e0a5fb11142c51c43978b4"},{"type":"FIX","url":"https://github.com/radare/radare2/issues/7265"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/radareorg/radare2","events":[{"introduced":"7b31601631810b1d84fb8568b94b9f7c887f9def"},{"last_affected":"7b31601631810b1d84fb8568b94b9f7c887f9def"},{"fixed":"d2632f6483a3ceb5d8e0a5fb11142c51c43978b4"}],"database_specific":{"cpe":"cpe:2.3:a:radare:radare2:1.3.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.3.0"},{"last_affected":"1.3.0"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["1.3.0","1.3.0-git"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7854.json","vanir_signatures_modified":"2026-08-07T14:53:37Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/d2632f6483a3ceb5d8e0a5fb11142c51c43978b4","target":{"file":"libr/bin/format/wasm/wasm.c","function":"r_bin_wasm_get_element_entries"},"deprecated":false,"digest":{"function_hash":"230655148253589288958061650018985630215","length":993},"id":"CVE-2017-7854-323877fa"},{"target":{"file":"libr/bin/format/wasm/wasm.c"},"deprecated":false,"digest":{"line_hashes":["23064503938533862965036779265507038289","75687207364331261030419399804016142679","3285875785194008126866398608257989505","115724333109661787341509706680148962863","33508223124529990325032710706777349407","24186446093081999744067227057960734896","224537788075113192254570036892252307143","139736949258129745897427221961159676130","202324843410836778869144896865789929126","331495158313242461245008898982216478959","302746456341054249019821053853766451277","289327409731370596930323074466621727746","242483317687057525001820951353820657635","68445498772755956524426034572912270089","132484732282455191330004551635005414672","158497085298770703397383896519765946213","88399385709452418215959052903788338300","312976842217690933083724263323149036679","319748796475456796268501352248025989183","85648327910994474173812519271842892638","163266931817511511734580783522305695317","271845702251807196673245342094700614238","310503074136651463302205663512403961880","305270179476833802350713156201701930572","322862898973115517751609370511554625193","239039257341181585593814971651036184620","9418574509137915373115128081409581060","310827779329396562238603902013100009743","141728099614950991160782106431181664188","157078369585408058791568120045543864416","173011988595716047843404909394404008974","20914479174847643275944558984229772145","194991715211060034320715869273306655876","36787220603006652122166321483034816446","315526277714400569325802049770283186212","24466610932215497011172266789212171836","141002875379370336573508391390296504545","158096692388351026869413671558727716802","285581165474525066127390359536403618850","337357027035097416729145414896871292825","34461058677341885401388700642640972690","4910674637653867362062332232453964601","177407751000405554003695973395070245832","280432103186151742643614925013570140989","174888276433541926990468694601628172041","290790616536288491265387322651919017614","80117870439266891204813964799532354295","333486996912640775866941932578516957553","68445498772755956524426034572912270089","132484732282455191330004551635005414672","158497085298770703397383896519765946213","88399385709452418215959052903788338300","157203605032836661905334017444437755945","159920823526503334837778977189728495692","315776956590211208670376621733328822492","68445498772755956524426034572912270089","132484732282455191330004551635005414672","158497085298770703397383896519765946213","88399385709452418215959052903788338300","4381485118661763231845553461478387923","156819963178951790988850409587351059692","336811635192435355928391444173768407027","329931369816420436734207708051583054526","10780231780835626603863719608924387540","305270179476833802350713156201701930572","322862898973115517751609370511554625193","239039257341181585593814971651036184620","327478915262647194333302400087245331677","162381198981787154071001266406104151378","221297791088818865198524390335448605604","322205106299132562983289426043165714770","105533365817354480363379688420408371853","295538905123418025275895720666961548902","73260050421334791646861682869293832184","52211022993740452950981275640868944081","51033398667855259070517305868706341226","215934601112160160795462837133397281062","150222569091813732744666780803308639360","214057002058016630508668917727183229240","19388299981499478999442448049841798165","171667868786585619177634868000964031174","22874582870898425970408916742311179275","266363600733995334939823541787789874276","285581165474525066127390359536403618850","337357027035097416729145414896871292825","237504891096311520510804210405269094989"],"threshold":0.9},"id":"CVE-2017-7854-394f7b7c","signature_type":"Line","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/d2632f6483a3ceb5d8e0a5fb11142c51c43978b4"},{"deprecated":false,"digest":{"length":977,"function_hash":"317733898788903217491246749717907220566"},"id":"CVE-2017-7854-9b2171a5","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/d2632f6483a3ceb5d8e0a5fb11142c51c43978b4","target":{"file":"libr/bin/format/wasm/wasm.c","function":"r_bin_wasm_get_global_entries"}},{"target":{"file":"libr/bin/format/wasm/wasm.c","function":"r_bin_wasm_get_data_entries"},"deprecated":false,"digest":{"function_hash":"100548069398976928867257847570735586705","length":906},"id":"CVE-2017-7854-afbcfe29","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/d2632f6483a3ceb5d8e0a5fb11142c51c43978b4"},{"deprecated":false,"digest":{"function_hash":"174184899885304418912855136059178748671","length":292},"id":"CVE-2017-7854-c588e1ae","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/d2632f6483a3ceb5d8e0a5fb11142c51c43978b4","target":{"function":"consume_init_expr","file":"libr/bin/format/wasm/wasm.c"}}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}