CVE-2025-15412

· MEDIUMModified

← All CVEs

CVSS v3.1

5.3

CVSS v4.0

1.9

EPSS

0.18%

Published

Jan 1, 2026

Modified

Apr 28, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. Such manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-119CWE-125

Affected Products (1)

webassembly · wabtvulnerable

References (6)

https://github.com/WebAssembly/wabt/

https://github.com/WebAssembly/wabt/issues/2678

ExploitIssue TrackingVendor Advisory

https://github.com/oneafter/1208/blob/main/af1

Exploit