CVE-2025-15412

MediumPublic PoC

Published: 01 January 2026

Published

01 January 2026

Modified

23 February 2026

KEV Added

—

Patch

—

CVSS Score 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0003 10.0th percentile

Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-15412 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Webassembly Wabt. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 10.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Data from Local System (T1005).

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SA-11 Developer Testing and Evaluation

addresses: CWE-119

Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.

SC-27 Platform-independent Applications

addresses: CWE-119

Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.

SI-16 Memory Protection

addresses: CWE-119

Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.

SI-4 System Monitoring

addresses: CWE-119

Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

Local out-of-bounds read enables limited memory disclosure from the decompiler process, directly mapping to data collection from the local system.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. Such manipulation leads to out-of-bounds read. Local access is required to approach this attack.…

The exploit has been disclosed publicly and may be used. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

Deeper analysisAI

CVE-2025-15412, published on 2026-01-01, is an out-of-bounds read vulnerability (CWE-119, CWE-125) in WebAssembly wabt versions up to 1.0.39. It affects the wabt::Decompiler::VarName function within the wasm-decompile component, located at /src/repro/wabt/bin/wasm-decompile.

The vulnerability requires local access (AV:L), low attack complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), and has no impact on scope (S:U). An attacker with these conditions can achieve limited disclosure of information (C:L), limited modification of data (I:L), and limited denial of service (A:L), resulting in a CVSS v3.1 base score of 5.3 (Medium).

Advisories note that the exploit has been publicly disclosed and may be used, with proof-of-concept available. The wabt project has no active maintainer, and responders to the issue report recommended that the researcher submit a pull request. Details are documented in GitHub issue #2678 and VulDB entries (ctiid.339333, id.339333).