CVE-2025-15412

HIGH

A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile of the componen...

Affects 1 product across 1 vendor.

CVSS 3.17.8
CVSS v41.9
EPSS0.2%
Percentile10th
PatchUnknown
CVSS Vector — Plain English Requires local access, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-119: Improper Restriction of Operations within Memory Buffer

Parent class for buffer-related vulnerabilities where operations exceed buffer boundaries.

CWE-125: Out-of-Bounds Read

Software reads data past the boundary of an allocated buffer, leaking sensitive information or causing crashes.

Related Attack Patterns (CAPEC)
CAPEC-8 Buffer Overflow in an API Call
via CWE-119
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
via CWE-119
CAPEC-10 Buffer Overflow via Environment Variables
via CWE-119
CAPEC-14 Client-side Injection-induced Buffer Overflow
via CWE-119
CAPEC-24 Filter Failure through Buffer Overflow
via CWE-119
Show all 13

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A security vulnerability in WebAssembly wabt up to version 1.0.39 allows for an out-of-bounds read in the wabt::Decompiler::VarName function, potentially leading to information disclosure or other unspecified impacts.

BSID: BS-2026-GLOBAL-234748-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-15412?
A security vulnerability in WebAssembly wabt up to version 1.0.39 allows for an out-of-bounds read in the wabt::Decompiler::VarName function, potentially leading to information disclosure or other unspecified impacts.
What is the CVSS score for CVE-2025-15412?
CVE-2025-15412 has CVSS 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.2%.
Is CVE-2025-15412 actively exploited?
No confirmed active exploitation of CVE-2025-15412 as of 2026-10-09.
How do I remediate CVE-2025-15412?
Priority: HIGH. PSIRT: [email protected]
What systems are affected by CVE-2025-15412?
CVE-2025-15412 affects Webassembly Wabt.
Vulnerability Details
CVE IDCVE-2025-15412
BSIDBS-2026-GLOBAL-234748-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published2026-01-01
Last Modified2026-10-07
ICS Relevance15%
Weakness (CWE)
Improper Restriction of Operations within Memory BufferOut-of-Bounds Read
SourceNVD
Official Description

A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. Such manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability can be exploited by a local attacker who can manipulate the input to the wabt::Decompiler::VarName function, leading to an out-of-bounds read. The exploit has been publicly disclosed and may be used by malicious actors.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Webassembly Wabt ≤ 1.0.39
Remediation

No official vendor advisory link on record. See the CVE record →

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 287 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash7112b270d33c1c5e40ff17fb499d37bedc079f4a16ceacee5c58e10f1d9762789b4bf47f4b1e516bd694235c4a876b58d868b1d584c8a8fbe5b5b6641461d807
Related CVEs affecting Webassembly
CVE-2024-32980 9.1 Spin is the developer tool for building and running serverless applications p... CVE-2025-2368 8.8 A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critic... CVE-2025-15411 7.8 A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnera... CVE-2022-43281 7.8 wasm-interp v1.0.29 was discovered to contain a heap overflow via the compone... CVE-2023-27117 7.8 WebAssembly v1.0.29 was discovered to contain a heap overflow via the compone...
View all Webassembly CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →