CVE-2025-15412

NameCVE-2025-15412
DescriptionA security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. Such manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
wabt (PTS)bullseye1.0.20-1vulnerable
bookworm1.0.32-1vulnerable
forky, sid, trixie1.0.36+dfsg+~cs1.0.36-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
wabtsource(unstable)(unfixed)unimportant

Notes

https://github.com/WebAssembly/wabt/issues/2678
Crash in CLI tool, no security impact

Search for package or bug name: Reporting problems