CVE-2025-15412
Published: 01 January 2026
Summary
CVE-2025-15412 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Webassembly Wabt. Its CVSS base score is 4.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 8.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-15412, published on 2026-01-01, is an out-of-bounds read vulnerability (CWE-119, CWE-125) in WebAssembly wabt versions up to 1.0.39. It affects the wabt::Decompiler::VarName function within the wasm-decompile component, located at /src/repro/wabt/bin/wasm-decompile.
The vulnerability requires local access (AV:L), low attack complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), and has no impact on scope (S:U). An attacker with these conditions can achieve limited disclosure of information (C:L), limited modification of data (I:L), and limited denial of service (A:L), resulting in a CVSS v3.1 base score of 5.3 (Medium).
Advisories note that the exploit has been publicly disclosed and may be used, with proof-of-concept available. The wabt project has no active maintainer, and responders to the issue report recommended that the researcher submit a pull request. Details are documented in GitHub issue #2678 and VulDB entries (ctiid.339333, id.339333).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-0003
Vulnerability details
A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. Such manipulation leads to out-of-bounds read. Local access is required to approach this attack.…
more
The exploit has been disclosed publicly and may be used. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local out-of-bounds read enables limited memory disclosure from the decompiler process, directly mapping to data collection from the local system.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly implements memory protections that block out-of-bounds reads in functions such as wabt::Decompiler::VarName.
Requires timely application of patches or mitigations for the publicly disclosed OOB-read flaw in wabt <= 1.0.39.
Addresses continued use of the now-unsupported wabt component that has no active maintainer and therefore no security updates.