CVE-2025-15411

Katalog CVE

CVSS 7.8 · High EPSS 0,21%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada webassembly wabt. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. This manipulation causes memory corruption. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

Rincian

Terbit di NVD

1 Januari 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WebAssembly/wabt/issues/2679 exploit · issue tracking · advisory vendor
• https://vuldb.com/?id.339332 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.719825 advisory pihak ketiga · vdb entry
• https://github.com/oneafter/1208/blob/main/af1 exploit
• https://github.com/WebAssembly/wabt/
• https://vuldb.com/?ctiid.339332 permissions required · vdb entry
• https://vuldb.com/?submit.736404