CVE-2025-15412

Katalog CVE

CVSS 7.8 · High EPSS 0,21%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada webassembly wabt. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. Such manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

Rincian

Terbit di NVD

1 Januari 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WebAssembly/wabt/issues/2678 exploit · issue tracking · advisory vendor
• https://vuldb.com/?id.339333 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.719826 advisory pihak ketiga · vdb entry
• https://github.com/oneafter/1208/blob/main/af1 exploit
• https://github.com/WebAssembly/wabt/
• https://vuldb.com/?ctiid.339333 permissions required · vdb entry