CVE-2025-15412: 
NixOS vulnerability analysis and mitigation

CVE-2025-15412 is an out-of-bounds read vulnerability in the WebAssembly Binary Toolkit (wabt) affecting all versions up to and including 1.0.39. The flaw resides in the wabt::Decompiler::VarName function within the wasm-decompile component (/src/repro/wabt/bin/wasm-decompile), triggered when processing malformed WebAssembly binaries. It was reported on December 8, 2025, and published as a CVE on January 1, 2026. The CVSS v3.1 base score assigned by NIST/NVD is 7.8 (High), while the CNA (VulDB) rates it 5.3 (Medium); the CVSS v4.0 score from VulDB is 1.9 (Low) (GitHub Issue, VulDB).

The root cause is improper restriction of operations within the bounds of a memory buffer (CWE-119) leading to an out-of-bounds read (CWE-125). When wasm-decompile processes a crafted malformed WebAssembly binary, the wabt::Decompiler::VarName function dereferences an invalid high-value memory address during variable name resolution, causing a segmentation fault (SEGV). The crash propagates through the call chain: VarName → DecompileExpr → Decompile. Exploitation requires local access with low privileges and no user interaction. The issue was confirmed via AddressSanitizer (ASan) on a Release build (with NDEBUG) on Linux x86_64, and a proof-of-concept reproducer binary has been publicly disclosed (GitHub Issue, PoC Repo).

Successful exploitation can result in a crash of the wasm-decompile process (availability impact), potential exposure of sensitive memory contents through the out-of-bounds read (confidentiality impact), and possible data corruption (integrity impact). The attack surface is limited to local users who can supply malformed WebAssembly binaries to the wasm-decompile tool, reducing the risk of widespread exploitation. Lateral movement potential is low given the local-only attack vector, but the lack of an active maintainer means the vulnerability may persist indefinitely (Feedly, GitHub Issue).

A public proof-of-concept reproducer file is available on GitHub, and the exploit has been disclosed publicly (PoC Repo, GitHub Issue). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVE is detected by Nessus plugin 281608 (Tenable).

1. Obtain the tool: Ensure wasm-decompile from wabt version ≤ 1.0.39 is installed on the target system (e.g., via apt install wabt or a compiled binary).
2. Craft or obtain a malformed WebAssembly binary: Use the publicly available proof-of-concept reproducer file from https://github.com/oneafter/1208/blob/main/af1, or craft a WebAssembly binary with malformed variable name references that trigger invalid memory access in VarName.
3. Execute the decompiler against the malicious binary: Run ./wasm-decompile ./repro (or equivalent path to the malformed .wasm file) as a local low-privilege user.
4. Trigger the crash: The wabt::Decompiler::VarName function dereferences an invalid high-value address during variable name resolution, causing a SEGV and crashing the process — potentially leaking memory contents or enabling further exploitation depending on memory layout (GitHub Issue, PoC Repo).

• Process: Unexpected crashes or segmentation faults of the wasm-decompile process; core dump files generated by wasm-decompile in working directories.
• Logs: System logs (e.g., /var/log/syslog) showing SIGSEGV signals from wasm-decompile; AddressSanitizer output referencing wabt::Decompiler::VarName with DEADLYSIGNAL or SEGV on unknown address.
• File System: Presence of unexpected or unfamiliar .wasm binary files in directories accessible to wasm-decompile; core dump files (e.g., core.*) in the working directory of the process.
• Network: No network-based IOCs expected given the local-only attack vector.

No official patch is currently available, as the wabt project lacks an active maintainer and the issue remains open (GitHub Issue). The latest release (1.0.41 as of May 2026) should be evaluated to determine if the issue has been addressed incidentally; users should monitor the repository for community-contributed fixes or pull requests. In the interim, recommended mitigations include: (1) restricting local access to systems running wabt tools; (2) avoiding processing of untrusted or unknown WebAssembly binaries with wasm-decompile; (3) applying process isolation or sandboxing (e.g., containers, seccomp profiles) for wasm-decompile operations; and (4) considering alternative WebAssembly decompilation tools (WABT Repo).

The issue was reported by researcher "oneafter" on December 8, 2025, via the wabt GitHub issue tracker, where a community member suggested the researcher submit a pull request themselves — highlighting the project's lack of active maintenance (GitHub Issue). The vulnerability was assigned a CVE by VulDB and received coverage from automated vulnerability tracking services. No significant vendor statements, notable researcher commentary, or major media coverage has been identified beyond the initial issue report and standard CVE aggregation.