CVE-2025-15411

HIGH

A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-d...

Affects 1 product across 1 vendor.

CVSS 3.17.8
CVSS v41.9
EPSS0.2%
Percentile10th
PatchUnknown
CVSS Vector — Plain English Requires local access, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-119: Improper Restriction of Operations within Memory Buffer

Parent class for buffer-related vulnerabilities where operations exceed buffer boundaries.

Related Attack Patterns (CAPEC)
CAPEC-8 Buffer Overflow in an API Call
via CWE-119
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
via CWE-119
CAPEC-10 Buffer Overflow via Environment Variables
via CWE-119
CAPEC-14 Client-side Injection-induced Buffer Overflow
via CWE-119
CAPEC-24 Filter Failure through Buffer Overflow
via CWE-119
Show all 12

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A memory corruption vulnerability exists in WebAssembly wabt up to version 1.0.39 affecting the wabt::AST::InsertNode function in the wasm-decompile component. This could lead to arbitrary code execution if exploited.

BSID: BS-2026-GLOBAL-234746-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-15411?
A memory corruption vulnerability exists in WebAssembly wabt up to version 1.0.39 affecting the wabt::AST::InsertNode function in the wasm-decompile component. This could lead to arbitrary code execution if exploited.
What is the CVSS score for CVE-2025-15411?
CVE-2025-15411 has CVSS 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.2%.
Is CVE-2025-15411 actively exploited?
No confirmed active exploitation of CVE-2025-15411 as of 2026-10-09.
How do I remediate CVE-2025-15411?
Priority: IMMEDIATE. PSIRT: [email protected]
What systems are affected by CVE-2025-15411?
CVE-2025-15411 affects Webassembly Wabt.
Vulnerability Details
CVE IDCVE-2025-15411
BSIDBS-2026-GLOBAL-234746-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published2026-01-01
Last Modified2026-10-07
ICS Relevance15%
Weakness (CWE)
Improper Restriction of Operations within Memory Buffer
SourceNVD
Official Description

A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. This manipulation causes memory corruption. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability can be exploited locally by manipulating the input to the wabt::AST::InsertNode function, potentially leading to memory corruption.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Webassembly Wabt ≤ 1.0.39
Remediation

No official vendor advisory link on record. See the CVE record →

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 287 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashc23d156b39d087d6f77354c76f173d9c8e82c5ea9b9782916803e0ebf17a9adfffe0d542ab9d9e20c75f9dfb03750f9b4556abc1da337f22133942ed5bf7d4f3
Related CVEs affecting Webassembly
CVE-2024-32980 9.1 Spin is the developer tool for building and running serverless applications p... CVE-2025-2368 8.8 A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critic... CVE-2025-15412 7.8 A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. ... CVE-2022-43281 7.8 wasm-interp v1.0.29 was discovered to contain a heap overflow via the compone... CVE-2023-27117 7.8 WebAssembly v1.0.29 was discovered to contain a heap overflow via the compone...
View all Webassembly CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →