CVE-2025-15411 - WebAssembly wabt wasm-decompile InsertNode memory corruption

Back Back to CVE browser

MEDIUM

WebAssembly wabt wasm-decompile InsertNode memory corruption

Published Jan 1, 2026

4.8

MEDIUM

CVSS 4.0

EPSS 0.21%

Description

A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. This manipulation causes memory corruption. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

Affected products

Vendor WebAssembly Product Wabt Default
n/a
- Version
  1.0.0
  Status
  affected
  Constraints
  -
- Version
  1.0.1
  Status
  affected
  Constraints
  -
- Version
  1.0.10
  Status
  affected
  Constraints
  -
- Version
  1.0.11
  Status
  affected
  Constraints
  -
- Version
  1.0.12
  Status
  affected
  Constraints
  -
- Version
  1.0.13
  Status
  affected
  Constraints
  -
- Version
  1.0.14
  Status
  affected
  Constraints
  -
- Version
  1.0.15
  Status
  affected
  Constraints
  -
- Version
  1.0.16
  Status
  affected
  Constraints
  -
- Version
  1.0.17
  Status
  affected
  Constraints
  -
- Version
  1.0.18
  Status
  affected
  Constraints
  -
- Version
  1.0.19
  Status
  affected
  Constraints
  -
- Version
  1.0.2
  Status
  affected
  Constraints
  -
- Version
  1.0.20
  Status
  affected
  Constraints
  -
- Version
  1.0.21
  Status
  affected
  Constraints
  -
- Version
  1.0.22
  Status
  affected
  Constraints
  -
- Version
  1.0.23
  Status
  affected
  Constraints
  -
- Version
  1.0.24
  Status
  affected
  Constraints
  -
- Version
  1.0.25
  Status
  affected
  Constraints
  -
- Version
  1.0.26
  Status
  affected
  Constraints
  -
- Version
  1.0.27
  Status
  affected
  Constraints
  -
- Version
  1.0.28
  Status
  affected
  Constraints
  -
- Version
  1.0.29
  Status
  affected
  Constraints
  -
- Version
  1.0.3
  Status
  affected
  Constraints
  -
- Version
  1.0.30
  Status
  affected
  Constraints
  -
- Version
  1.0.31
  Status
  affected
  Constraints
  -
- Version
  1.0.32
  Status
  affected
  Constraints
  -
- Version
  1.0.33
  Status
  affected
  Constraints
  -
- Version
  1.0.34
  Status
  affected
  Constraints
  -
- Version
  1.0.35
  Status
  affected
  Constraints
  -
- Version
  1.0.36
  Status
  affected
  Constraints
  -
- Version
  1.0.37
  Status
  affected
  Constraints
  -
- Version
  1.0.38
  Status
  affected
  Constraints
  -
- Version
  1.0.39
  Status
  affected
  Constraints
  -
- Version
  1.0.4
  Status
  affected
  Constraints
  -
- Version
  1.0.5
  Status
  affected
  Constraints
  -
- Version
  1.0.6
  Status
  affected
  Constraints
  -
- Version
  1.0.7
  Status
  affected
  Constraints
  -
- Version
  1.0.8
  Status
  affected
  Constraints
  -
- Version
  1.0.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

WebAssembly

Wabt

n/a

Version	Status	Constraints
1.0.0	affected	-
1.0.1	affected	-
1.0.10	affected	-
1.0.11	affected	-
1.0.12	affected	-
1.0.13	affected	-
1.0.14	affected	-
1.0.15	affected	-
1.0.16	affected	-
1.0.17	affected	-
1.0.18	affected	-
1.0.19	affected	-
1.0.2	affected	-
1.0.20	affected	-
1.0.21	affected	-
1.0.22	affected	-
1.0.23	affected	-
1.0.24	affected	-
1.0.25	affected	-
1.0.26	affected	-
1.0.27	affected	-
1.0.28	affected	-
1.0.29	affected	-
1.0.3	affected	-
1.0.30	affected	-
1.0.31	affected	-
1.0.32	affected	-
1.0.33	affected	-
1.0.34	affected	-
1.0.35	affected	-
1.0.36	affected	-
1.0.37	affected	-
1.0.38	affected	-
1.0.39	affected	-
1.0.4	affected	-
1.0.5	affected	-
1.0.6	affected	-
1.0.7	affected	-
1.0.8	affected	-
1.0.9	affected	-

Remediation

Red Hat statement

This vulnerability is rated Moderate as memory corruption flaw exists in the `wasm-decompile` component of WebAssembly Binary Toolkit (wabt), which can be exploited by a local attacker. This issue affects components like `wabt`, `firefox`, and `thunderbird` in Red Hat Enterprise Linux and Fedora.

Weaknesses (1)

CWE-119

Buffer Overflow

References (12)

https://access.redhat.com/security/cve/CVE-2025-15411
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2426683
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-0006
Advisory
https://github.com/WebAssembly/wabt/
product
https://github.com/WebAssembly/wabt/issues/2679
issue-trackingExploitIssue TrackingVendor Advisory
https://github.com/oneafter/1208/blob/main/af1
exploit
https://nvd.nist.gov/vuln/detail/CVE-2025-15411
https://vuldb.com/?ctiid.339332
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.339332
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.719825
third-party-advisoryThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.736404
third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2025-15411

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2025-15411		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2426683		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-0006		Advisory
https://github.com/WebAssembly/wabt/		product
https://github.com/WebAssembly/wabt/issues/2679		issue-trackingExploitIssue TrackingVendor Advisory
https://github.com/oneafter/1208/blob/main/af1		exploit
https://nvd.nist.gov/vuln/detail/CVE-2025-15411
https://vuldb.com/?ctiid.339332		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.339332		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.719825		third-party-advisoryThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.736404		third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2025-15411