{"id":"CVE-2018-17293","details":"An issue was discovered in WAVM before 2018-09-16. The run function in Programs/wavm/wavm.cpp does not check whether there is Emscripten memory to store the command-line arguments passed by the input WebAssembly file's main function, which allows attackers to cause a denial of service (application crash by NULL pointer dereference) or possibly have unspecified other impact by crafting certain WebAssembly files.","modified":"2026-07-08T14:14:57.385730Z","published":"2018-09-21T07:29:00.457Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:webassembly_virtual_machine_project:webassembly_virtual_machine:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"2018-09-16"}],"source":"CPE_RANGE","vendor_product":"webassembly_virtual_machine_project:webassembly_virtual_machine"},{"extracted_events":[{"fixed":"2018-09-16"}],"source":"DESCRIPTION"}]},"references":[{"type":"FIX","url":"https://github.com/WAVM/WAVM/commit/31d670b6489e6d708c3b04b911cdf14ac43d846d"},{"type":"FIX","url":"https://github.com/WAVM/WAVM/issues/110#issuecomment-421764693"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wavm/wavm","events":[{"introduced":"0"},{"fixed":"31d670b6489e6d708c3b04b911cdf14ac43d846d"}],"database_specific":{"source":"REFERENCES"}}],"database_specific":{"vanir_signatures_modified":"2026-07-08T14:14:57Z","vanir_signatures":[{"source":"https://github.com/wavm/wavm/commit/31d670b6489e6d708c3b04b911cdf14ac43d846d","target":{"file":"Programs/wavm/wavm.cpp","function":"run"},"deprecated":false,"digest":{"function_hash":"223932303632993575063340708268581817075","length":4326},"id":"CVE-2018-17293-766f067d","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["320000027779525796497406571864261378643","303074121024348770067694516215010702859","268723876264344264401013688696891683322","236585774404262886715641904444378310444","15634736109366250920333150109281842371","290360243184211282883699885563560318450","99430604633758981177210224798224771874","252631172378521555520088269925526948874","221739687104665159201932448089760617918","11689498126797467117947311927530697942","232930766379943851720026101142798233878","30913155390947140618337544289044782842","247461309769800258306856029146493917756","149880145767215881798272913643206570567","134623929401584405153413446138726944604","106271611649610550535499272594076420952"],"threshold":0.9},"id":"CVE-2018-17293-e2dafb4d","signature_type":"Line","signature_version":"v1","source":"https://github.com/wavm/wavm/commit/31d670b6489e6d708c3b04b911cdf14ac43d846d","target":{"file":"Programs/wavm/wavm.cpp"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-17293.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}