CVE-2025-15412: WebAssembly wabt wasm-decompile VarName out-of-bounds
A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. Such manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15412?
CVE-2025-15412 has a critical severity rating due to its potential for triggering out-of-bounds read vulnerabilities.
How do I fix CVE-2025-15412?
To fix CVE-2025-15412, upgrade the wabt/wasm-decompile component to version 1.0.40 or later.
What are the main risks associated with CVE-2025-15412?
The main risks associated with CVE-2025-15412 include potential arbitrary code execution and exposure of sensitive information.
Who is affected by CVE-2025-15412?
CVE-2025-15412 affects users running wabt/wasm-decompile version 1.0.39 or earlier.
Can CVE-2025-15412 be exploited remotely?
CVE-2025-15412 requires local access for exploitation, making it less of a remote threat.