WebAssembly wabt wasm-decompile VarName out-of-bounds_CVE-2025-15412

4.8 / 10

MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Description

A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. Such manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

Basic Information

ID CVE-2025-15412

Source VulDB

Published Jan 1, 2026 at 20:32

Affected Product

Vendor WebAssembly

Product wabt

Version 1.0.0

Affected Versions WebAssembly wabt 1.0.0
WebAssembly wabt 1.0.1
WebAssembly wabt 1.0.2
WebAssembly wabt 1.0.3
WebAssembly wabt 1.0.4
WebAssembly wabt 1.0.5
WebAssembly wabt 1.0.6
WebAssembly wabt 1.0.7
WebAssembly wabt 1.0.8
WebAssembly wabt 1.0.9
WebAssembly wabt 1.0.10
WebAssembly wabt 1.0.11
WebAssembly wabt 1.0.12
WebAssembly wabt 1.0.13
WebAssembly wabt 1.0.14
WebAssembly wabt 1.0.15
WebAssembly wabt 1.0.16
WebAssembly wabt 1.0.17
WebAssembly wabt 1.0.18
WebAssembly wabt 1.0.19
WebAssembly wabt 1.0.20
WebAssembly wabt 1.0.21
WebAssembly wabt 1.0.22
WebAssembly wabt 1.0.23
WebAssembly wabt 1.0.24
WebAssembly wabt 1.0.25
WebAssembly wabt 1.0.26
WebAssembly wabt 1.0.27
WebAssembly wabt 1.0.28
WebAssembly wabt 1.0.29
WebAssembly wabt 1.0.30
WebAssembly wabt 1.0.31
WebAssembly wabt 1.0.32
WebAssembly wabt 1.0.33
WebAssembly wabt 1.0.34
WebAssembly wabt 1.0.35
WebAssembly wabt 1.0.36
WebAssembly wabt 1.0.37
WebAssembly wabt 1.0.38
WebAssembly wabt 1.0.39

CWE Classification

CWE-125 CWE-119

References

{
    "lastseen": "",
    "description": "A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. Such manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.",
    "published": "2026-01-01T20:32:06.684Z",
    "modified": "2026-01-01T20:32:06.684Z",
    "type": "cve",
    "title": "WebAssembly wabt wasm-decompile VarName out-of-bounds",
    "source": "VulDB",
    "references": "https://vuldb.com/?id.339333\nhttps://vuldb.com/?ctiid.339333\nhttps://vuldb.com/?submit.719826\nhttps://github.com/WebAssembly/wabt/issues/2678\nhttps://github.com/oneafter/1208/blob/main/af1",
    "id": "CVE-2025-15412",
    "bulletinFamily": "",
    "cwe": [
        "CWE-125",
        "CWE-119"
    ],
    "cvelist": null,
    "sourceData": "WebAssembly wabt 1.0.0\nWebAssembly wabt 1.0.1\nWebAssembly wabt 1.0.2\nWebAssembly wabt 1.0.3\nWebAssembly wabt 1.0.4\nWebAssembly wabt 1.0.5\nWebAssembly wabt 1.0.6\nWebAssembly wabt 1.0.7\nWebAssembly wabt 1.0.8\nWebAssembly wabt 1.0.9\nWebAssembly wabt 1.0.10\nWebAssembly wabt 1.0.11\nWebAssembly wabt 1.0.12\nWebAssembly wabt 1.0.13\nWebAssembly wabt 1.0.14\nWebAssembly wabt 1.0.15\nWebAssembly wabt 1.0.16\nWebAssembly wabt 1.0.17\nWebAssembly wabt 1.0.18\nWebAssembly wabt 1.0.19\nWebAssembly wabt 1.0.20\nWebAssembly wabt 1.0.21\nWebAssembly wabt 1.0.22\nWebAssembly wabt 1.0.23\nWebAssembly wabt 1.0.24\nWebAssembly wabt 1.0.25\nWebAssembly wabt 1.0.26\nWebAssembly wabt 1.0.27\nWebAssembly wabt 1.0.28\nWebAssembly wabt 1.0.29\nWebAssembly wabt 1.0.30\nWebAssembly wabt 1.0.31\nWebAssembly wabt 1.0.32\nWebAssembly wabt 1.0.33\nWebAssembly wabt 1.0.34\nWebAssembly wabt 1.0.35\nWebAssembly wabt 1.0.36\nWebAssembly wabt 1.0.37\nWebAssembly wabt 1.0.38\nWebAssembly wabt 1.0.39",
    "sourceHref": "",
    "cvss": {
        "score": 4.8,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "wabt",
    "version": "1.0.0",
    "vendor": "WebAssembly",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}