Every CVESearch/Get API key

CVE-2025-15411

WebAssembly wabt wasm-decompile InsertNode memory corruption

4.8 Medium

CVE-2025-15411 is a medium vulnerability (CVSS 4.8) in Webassembly Wabt, published January 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. No source names a fixed version.

What does this mean?
Severity
4.8 MediumCVSS 4.0, CVE List
Exploit chance
0.21%EPSS, 10th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. This manipulation causes memory corruption. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.21%Up 0.2 points since Jan 2, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wabt
Debian:12
All versions, plus listed versions
1.0.32-11.0.33-11.0.34+dsfg+~cs1.0.32-11.0.34+dsfg2+~cs1.0.32-11.0.34+dsfg2+~cs1.0.32-2
Show 9 moreShow less
1.0.34+dsfg2+~cs1.0.32-31.0.34+dsfg2+~cs1.0.32-41.0.34-11.0.36+dfsg+~cs1.0.36-11.0.36+dfsg+~cs1.0.36-21.0.41+dfsg+~cs1.0.39-11.0.41+dfsg+~cs1.0.39-21.0.42+dfsg+~cs1.0.39-11.0.42+dfsg+~cs1.0.39-2
None known
wabt
Debian:13
All versions, plus listed versions
1.0.36+dfsg+~cs1.0.36-21.0.41+dfsg+~cs1.0.39-11.0.41+dfsg+~cs1.0.39-21.0.42+dfsg+~cs1.0.39-11.0.42+dfsg+~cs1.0.39-2
None known
wabt
Debian:14
All versions, plus listed versions
1.0.36+dfsg+~cs1.0.36-21.0.41+dfsg+~cs1.0.39-11.0.41+dfsg+~cs1.0.39-21.0.42+dfsg+~cs1.0.39-11.0.42+dfsg+~cs1.0.39-2
None known
wabt
Ubuntu:20.04:LTS
All versions, plus listed versions
1.0.11-11.0.12-11.0.13-11.0.13-1build1
None known
wabt
Ubuntu:22.04:LTS
All versions, plus listed versions
1.0.20-11.0.24-11.0.24-21.0.25-11.0.26-11.0.27-1
None known
wabt
Ubuntu:24.04:LTS
All versions, plus listed versions
1.0.33-11.0.34-11.0.34+dsfg2+~cs1.0.32-1ubuntu11.0.34+dsfg2+~cs1.0.32-1ubuntu2
None known
wabt
Ubuntu:25.10
All versions, plus listed versions
1.0.34+dsfg2+~cs1.0.32-1ubuntu21.0.36+dfsg+~cs1.0.36-2ubuntu1
None known
wabt
Ubuntu:26.10
All versions, plus listed versions
1.0.36+dfsg+~cs1.0.36-2ubuntu11.0.36+dfsg+~cs1.0.36-2ubuntu4
None known
wabt
Ubuntu:26.04:LTS
All versions, plus listed versions
1.0.36+dfsg+~cs1.0.36-2ubuntu1
None known

What each source reports

CVE List Score used4.8

WebAssembly wabt wasm-decompile InsertNode memory corruption

A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. This manipulation causes memory corruption. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

Record
CVE-2025-15411
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CVSS 3.0
5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CVSS 2.0
4.3 AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
Weakness
CWE-119
Updated
2026-11-02
EUVDEUVD-2026-00064.8

A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. This manipulation causes memory corruption. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

Record
EUVD-2026-0006
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-mw2p-3c2q-3gxg1.9

A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the...

A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. This manipulation causes memory corruption. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

Record
GHSA-mw2p-3c2q-3gxg
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-119
Updated
2026-11-02
NVD1.9

A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. This manipulation causes memory corruption. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

Record
CVE-2025-15411
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.3 MediumAV:L/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
OSV1.9

WebAssembly wabt wasm-decompile InsertNode memory corruption

A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. This manipulation causes memory corruption. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

Record
CVE-2025-15411
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-119
Updated
2026-11-02
OSVDEBIAN-CVE-2025-154117.8

A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. This manipulation causes memory corruption. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

Record
DEBIAN-CVE-2025-15411
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-154111.9

A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. This manipulation causes memory corruption. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

Record
UBUNTU-CVE-2025-15411
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 7 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open