Alerts This Week
Warning Icon 1 619
Alerts This Week
Warning Icon 1 619

Fedora 43 binaryen Critical Buffer Overflow Fix FEDORA-2026-fb3e461878

fedora
Calendar Grey April 30, 2026
Dist Fedora Esm H88
Critical update for Fedora 43 fixes buffer overflow in binaryen, enhancing security against CVE-2025-14956 threat.
Fixes CVE-2025-14956 .

Summary

Binaryen is a compiler and toolchain infrastructure library for WebAssembly,

written in C++. It aims to make compiling to WebAssembly easy, fast, and

effective:

* Easy: Binaryen has a simple C API in a single header, and can also be used

from JavaScript. It accepts input in WebAssembly-like form but also accepts

a general control flow graph for compilers that prefer that.

* Fast: Binaryen's internal IR uses compact data structures and is designed for

completely parallel codegen and optimization, using all available CPU cores.

Binaryen's IR also compiles down to WebAssembly extremely easily and quickly

because it is essentially a subset of WebAssembly.

* Effective: Binaryen's optimizer has many passes that can improve code very

significantly (e.g. local coloring to coalesce local variables; dead code

elimination; precomputing expressions when possible at compile time; etc.).

These optimizations aim to make Binaryen powerful enough to be used as a

compiler backend by itself. One specific area of focus is on

WebAssembly-specific optimizations (that general-purpose compilers might not

do), which you can think of as wasm minification , similar to minification for

JavaScript, CSS, etc., all of which are language-specific (an example of such

an optimization is block return value generation in SimplifyLocals).

Update Information:

Fixes CVE-2025-14956 .

Change Log

* Sun Feb 22 2026 Dominik Mierzejewski - 126-1 - update to 126 (resolves rhbz#2439791) - backport upstream fix for https://github.com/WebAssembly/binaryen/issues/8360 * Fri Jan 16 2026 Fedora Release Engineering - 125-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jan 16 2026 Fedora Release Engineering - 125-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild

References


[ 1 ] Bug #2429127 - CVE-2025-14956 binaryen: heap-based buffer overflow in WasmBinaryReader::readExpression() when parsing a malformed WebAssembly binary [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2429127

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-fb3e461878' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: binaryen
Product: Fedora 43
Version: 126
Release: 1.fc43
Summary: Compiler and toolchain infrastructure library for WebAssembly

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here