Catalogue CVE

CVE-2025-15412

wabt affected and fixed versions

[Catalogue CVE]

A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. Such manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Unfortunately, the project has no active maintainer at the moment. In a reply to the issue report somebody recommended to the researcher to provide a PR himself.

Gravité
High · CVSS 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.21% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
DebiantrixiewabtNot reportedAffectedDistribution reports no fix[CVE-2025-15412]
Debiantrixiewabt1.0.36+dfsg+~cs1.0.36-2Affected[CVE-2025-15412]
DebiansidwabtNot reportedAffectedDistribution reports no fix[CVE-2025-15412]
Debiansidwabt1.0.42+dfsg+~cs1.0.39-2Affected[CVE-2025-15412]
DebianforkywabtNot reportedAffectedDistribution reports no fix[CVE-2025-15412]
Debianforkywabt1.0.42+dfsg+~cs1.0.39-2Affected[CVE-2025-15412]
DebianbookwormwabtNot reportedAffectedDistribution reports no fix[CVE-2025-15412]
Debianbookwormwabt1.0.32-1Affected[CVE-2025-15412]
UnknownRelease not reportedwabtNot reportedUnknownSource applicability is not establishedProvider not reported
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedwabtNot reportedUnknownSource applicability is not establishedProvider not reported
DebianbookwormwabtNot reportedAffectedDistribution reports no fix[CVE-2025-15412]
Debianbookwormwabt1.0.32-1Affected[CVE-2025-15412]
DebianforkywabtNot reportedAffectedDistribution reports no fix[CVE-2025-15412]
Debianforkywabt1.0.42+dfsg+~cs1.0.39-2Affected[CVE-2025-15412]
DebiansidwabtNot reportedAffectedDistribution reports no fix[CVE-2025-15412]
Debiansidwabt1.0.42+dfsg+~cs1.0.39-2Affected[CVE-2025-15412]
DebiantrixiewabtNot reportedAffectedDistribution reports no fix[CVE-2025-15412]
Debiantrixiewabt1.0.36+dfsg+~cs1.0.36-2Affected[CVE-2025-15412]
Original provider fields
{
  "package_releases": [
    {
      "name": "wabt",
      "status": "vulnerable",
      "release": "sid",
      "version": "1.0.42+dfsg+~cs1.0.39-2"
    },
    {
      "name": "wabt",
      "status": "vulnerable",
      "release": "forky",
      "version": "1.0.42+dfsg+~cs1.0.39-2"
    },
    {
      "name": "wabt",
      "status": "vulnerable",
      "release": "trixie",
      "version": "1.0.36+dfsg+~cs1.0.36-2"
    },
    {
      "name": "wabt",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "1.0.32-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "wabt",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "wabt",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "wabt",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "wabt",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "wabt",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "wabt",
      "ranges": [
        {
          "fixed": "",
          "introduced": "",
          "last_affected": "1.0.39",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15412",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2025-15412",
      "provider_updated_at": "2026-10-07T11:10:00.153"
    }
  ]
}

OpenFactory catalog packages

L’association des paquets est en cours.

[Debian 12 (Bookworm)]

  • [wabt]Inconnu
    Détails (2)

    • 1.0.32-1 · amd64 · bookworm

      Affectée

      dsa · wabt · debian · bookworm; dsa · wabt · debian · 12

    • 1.0.32-1 · arm64 · bookworm

      Affectée

      dsa · wabt · debian · bookworm; dsa · wabt · debian · 12

[Debian 13 (Trixie)]

  • [wabt]Inconnu
    Détails (2)

    • 1.0.36+dfsg+~cs1.0.36-2 · amd64 · trixie

      Affectée

      dsa · wabt · debian · 13

    • 1.0.36+dfsg+~cs1.0.36-2 · arm64 · trixie

      Affectée

      dsa · wabt · debian · 13

Observé:

Références

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]