CVE-2025-15411

NameCVE-2025-15411
DescriptionA weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. This manipulation causes memory corruption. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
wabt (PTS)bullseye1.0.20-1vulnerable
bookworm1.0.32-1vulnerable
forky, sid, trixie1.0.36+dfsg+~cs1.0.36-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
wabtsource(unstable)(unfixed)unimportant

Notes

https://github.com/WebAssembly/wabt/issues/2679
Crash in CLI tool, no security impact

Search for package or bug name: Reporting problems