{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.0.36"}],"component":"wabt-bin","cve_ids":["CVE-2025-2584"],"ecosystem":"PyPI","epss":0.0051,"exploited":false,"fixed_versions":[],"id":"tcs_01M5KGPAK3CZRS2MVJ64M0P370","modified_at":"2026-05-21T15:00:34.365707330Z","published_at":"2025-03-21T08:15:11.273Z","references":["https://osv.dev/vulnerability/PYSEC-2025-228","https://vuldb.com/?id.300544","https://vuldb.com/?submit.515406","https://github.com/WebAssembly/wabt/issues/2557","https://github.com/WebAssembly/wabt/issues/2557#issue-2900405517","https://vuldb.com/?ctiid.300544"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"PYSEC-2025-228","url":"https://osv.dev/vulnerability/PYSEC-2025-228"}],"summary":"A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCallDropKeepCount of the file wabt/src/inte"}