CVE-2025-15412
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
An out-of-bounds read vulnerability was found in WebAssembly wabt up to 1.0.39, in the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile. Local access is required for the attack.
Risk Assessment
A local attacker can exploit the out-of-bounds read to gain unauthorized access to data or cause a program crash.
Recommendation
Update wabt to a version newer than 1.0.39 if available, or apply a security patch to the VarName function.
Other vulnerabilities in wabt
See all- CVE-2026-90648High
wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations, primarily on 32-bit platforms (a "table flip" attack). It does not check the return value of calloc() in wasm_rt_allocate_funcref_table(); when the funcref table allocation fails, table->data remains NULL while table->size keeps the guest-declared element count, enabling arbitrary read/write of host memory and arbitrary code execution. Exploitation requires the allocation to fail, e.g., under an address-space limit, on 32-bit hosts, or under memory pressure.
- CVE-2025-15411Medium
A vulnerability in WebAssembly wabt up to 1.0.39 affects the function wabt::AST::InsertNode in the file /src/repro/wabt/bin/wasm-decompile of the wasm-decompile component. The manipulation causes memory corruption. The attack can be launched on the local host, and the exploit has been made publicly available.
Original NVD description (English source)
A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. Such manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS