CVE-2024-35419

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35419
wac commit 385e1 was discovered to contain a heap overflow via the load_module function at /wac-asan/wa.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted wasm file.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gist.github.com/haruki3hhh/8b9e1922083abef33a9024017eb2b9fe Third Party Advisory
https://github.com/kanaka/wac/issues/18 Exploit Third Party Advisory Issue Tracking
Configurations

Configuration 1 (hide)

cpe:2.3:a:kanaka:wac:2019-10-01:*:*:*:*:*:*:*
History

17 Jun 2025, 01:34

Type Values Removed Values Added
First Time Kanaka wac
Kanaka
CPE cpe:2.3:a:kanaka:wac:2019-10-01:*:*:*:*:*:*:*
References () https://gist.github.com/haruki3hhh/8b9e1922083abef33a9024017eb2b9fe - () https://gist.github.com/haruki3hhh/8b9e1922083abef33a9024017eb2b9fe - Third Party Advisory
References () https://github.com/kanaka/wac/issues/18 - () https://github.com/kanaka/wac/issues/18 - Exploit, Third Party Advisory, Issue Tracking

12 Nov 2024, 16:35

Type Values Removed Values Added
CWE CWE-120
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

12 Nov 2024, 13:56

Type Values Removed Values Added
Summary
  • (es) Se descubrió que el commit 385e1 de wac contenía un desbordamiento de pila a través de la función load_module en /wac-asan/wa.c. Esta vulnerabilidad permite a los atacantes provocar una denegación de servicio (DoS) a través de un archivo wasm manipulado a medida.

08 Nov 2024, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-08 22:15

Updated : 2025-06-17 01:34

NVD link : CVE-2024-35419

Mitre link : CVE-2024-35419

CVE.ORG link : CVE-2024-35419

JSON object : View

Products Affected

kanaka

  • wac
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')