CVE-2025-15411
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability in WebAssembly wabt up to 1.0.39 affects the function wabt::AST::InsertNode in the file /src/repro/wabt/bin/wasm-decompile of the wasm-decompile component. The manipulation causes memory corruption. The attack can be launched on the local host, and the exploit has been made publicly available.
Risk Assessment
A local attacker can leverage the publicly available exploit to cause memory corruption, potentially leading to a crash or code execution. The project currently has no active maintainer, which hinders a quick fix.
Recommendation
Restrict access to the wasm-decompile tool to trusted users only and consider suspending its use until a fix is available. Monitor the project repository for updates or submit a fix (PR) yourself.
Other vulnerabilities in wabt
See all- CVE-2026-90648High
wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations, primarily on 32-bit platforms (a "table flip" attack). It does not check the return value of calloc() in wasm_rt_allocate_funcref_table(); when the funcref table allocation fails, table->data remains NULL while table->size keeps the guest-declared element count, enabling arbitrary read/write of host memory and arbitrary code execution. Exploitation requires the allocation to fail, e.g., under an address-space limit, on 32-bit hosts, or under memory pressure.
- CVE-2025-15412Medium
An out-of-bounds read vulnerability was found in WebAssembly wabt up to 1.0.39, in the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile. Local access is required for the attack.
Original NVD description (English source)
A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. This manipulation causes memory corruption. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS