How severe is CVE-2023-31670?

CVE-2023-31670 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2023-31670 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-31670?

CVE-2023-31670 affects Webassembly Webassembly Binary Toolkit. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-31670?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2023-31670 published?

CVE-2023-31670 was published on 2023-05-23 and last updated on 2026-06-17.

CVE-2023-31670

CVE-2023-31670 is a high-severity vulnerability in Webassembly Webassembly Binary Toolkit with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.5)
EPSS exploit prediction: 1% (53rd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Webassembly Webassembly Binary Toolkit
Published: 2023-05-23
Last modified: 2026-06-17

Description

An issue in wasm2c 1.0.32, wasm2wat 1.0.32, wasm-decompile 1.0.32, and wasm-validate 1.0.32 allows attackers to cause a Denial of Service (DoS) via running a crafted binary.

Frequently asked questions

What is CVE-2023-31670?: An issue in wasm2c 1.0.32, wasm2wat 1.0.32, wasm-decompile 1.0.32, and wasm-validate 1.0.32 allows attackers to cause a Denial of Service (DoS) via running a crafted binary.
How severe is CVE-2023-31670?: CVE-2023-31670 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2023-31670 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-31670?: CVE-2023-31670 affects Webassembly Webassembly Binary Toolkit. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-31670?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2023-31670 published?: CVE-2023-31670 was published on 2023-05-23 and last updated on 2026-06-17.

References

https://github.com/WebAssembly/wabt/issues/2199

Affected products (1)

cpe:2.3:a:webassembly:webassembly_binary_toolkit:1.0.32:*:*:*:*:*:*:*

More vulnerabilities in Webassembly Webassembly Binary Toolkit

CVE-2023-46331 — Medium (CVSS 5.5): WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange(), which lead to segmentation…
CVE-2023-46332 — Medium (CVSS 5.5): WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop(), which lead to segmentation fault.
CVE-2023-31669 — Medium (CVSS 5.5): WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote (").
CVE-2025-3122 — Low (CVSS 3.1): A vulnerability classified as problematic was found in WebAssembly wabt 1.0.36. Affected by this vulnerability is the…

All CVEs affecting Webassembly Webassembly Binary Toolkit →