CVE-2025-15413: 
NixOS vulnerability analysis and mitigation

CVE-2025-15413 is a memory corruption vulnerability affecting the wasm3 WebAssembly interpreter up to and including version 0.5.0. The flaw resides in the op_SetSlot_i32 and op_CallIndirect functions within m3_exec.h, where improper bounds checking leads to out-of-bounds memory access. The vulnerability was disclosed on January 1, 2026, with public exploit code available via GitHub issue reports filed in December 2025. It carries a CVSS v3.1 base score of 7.8 (High) per NVD, while the CNA (VulDB) rates it 5.3 (Medium) (NVD, VulDB). Notably, the wasm3 project currently has no active maintainer, meaning no official patch is forthcoming (wasm3 GitHub).

The vulnerability is classified under CWE-787 (Out-of-bounds Write) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). In op_SetSlot_i32, the interpreter fails to validate the slot index or stack boundary before writing a 32-bit integer value to the WebAssembly interpreter stack, resulting in an out-of-bounds write (SEGV on WRITE). A related issue in op_CallIndirect involves an out-of-bounds read when performing indirect function calls via an invalid table index or pointer without sufficient bounds checking (SEGV on READ). Both crashes are reproducible in release builds compiled with Clang on Linux x86_64, confirmed via AddressSanitizer, and triggered by supplying a crafted WebAssembly binary to the wasm3 interpreter (GitHub Issue #543, GitHub Issue #547).

Successful exploitation can result in memory corruption affecting confidentiality, integrity, and availability of the wasm3 process. An attacker with local access and low privileges can cause application crashes (denial of service), potentially read or corrupt adjacent memory regions, and in the worst case leverage the out-of-bounds write for code execution within the context of the interpreter process. The impact is limited to the local system running wasm3, with no direct lateral movement potential, but embedded or IoT deployments using wasm3 as a plugin or scripting engine could face broader consequences (NVD, GitHub Issue #543).

Public proof-of-concept exploit code exists in the form of reproducible crash cases (crafted WebAssembly binaries) shared in the wasm3 GitHub issue tracker (GitHub Issue #543, GitHub Issue #547). The CVSS v4.0 exploit maturity is rated "Proof of Concept" by VulDB. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of widespread exploitation in the near term. There is no evidence of in-the-wild exploitation, threat actor attribution, inclusion in exploit kits, or listing in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Prepare environment: Obtain a local system with wasm3 version 0.5.0 or earlier installed (Linux x86_64 confirmed affected).
2. Craft malicious WebAssembly binary: Create a .wasm file that triggers the vulnerable code paths — specifically, a module that causes op_SetSlot_i32 to write to an out-of-bounds stack slot, or op_CallIndirect to read from an invalid function table index. The PoC files referenced in GitHub issues #543 and #547 demonstrate this.
3. Execute the payload: Run the crafted binary through the wasm3 interpreter: ./wasm3 repro.wasm
4. Trigger memory corruption: The interpreter processes the malicious opcodes without proper bounds validation, causing a segmentation fault (SEGV on WRITE for op_SetSlot_i32, SEGV on READ for op_CallIndirect) at the vulnerable function in m3_exec.h.
5. Achieve objective: Depending on memory layout and exploitation sophistication, the attacker may achieve a crash (DoS), memory disclosure, or potentially arbitrary code execution within the wasm3 process context (GitHub Issue #543, GitHub Issue #547).

• Process: Unexpected crashes or segmentation faults in the wasm3 process; abnormal termination of applications embedding wasm3 as a library.
• Logs: AddressSanitizer output referencing op_SetSlot_i32 or op_CallIndirect in m3_exec.h; crash dumps with stack traces pointing to m3_CallArgv → repl_call → main call chains.
• File System: Presence of unexpected or untrusted .wasm files submitted to the wasm3 interpreter, particularly those with unusual opcode sequences targeting indirect calls or slot operations.
• Network: In embedded/IoT deployments, unexpected outbound connections from the wasm3 host process following execution of an untrusted WebAssembly module (GitHub Issue #543, GitHub Issue #547).

No official patch is available, as the wasm3 project has no active maintainer and the latest release remains v0.5.0 (June 2021) (wasm3 GitHub). Organizations using wasm3 should consider the following mitigations: (1) avoid executing untrusted WebAssembly binaries with wasm3; (2) run wasm3 in a sandboxed or containerized environment with restricted privileges to limit the blast radius of exploitation; (3) evaluate migration to actively maintained WebAssembly runtimes (e.g., Wasmtime, WasmEdge) that receive regular security updates; (4) monitor the wasm3 repository for community-contributed pull requests that may address the bounds-checking deficiencies (Red Hat CVE).

Red Hat has acknowledged the vulnerability and published a CVE advisory page, though no Red Hat products are listed as directly affected (Red Hat CVE). The wasm3 maintainer has previously noted that the project is in a minimal maintenance phase due to personal circumstances (home destroyed during the Russian invasion of Ukraine), which compounds the lack of a fix (wasm3 GitHub). Community discussion has been limited to the GitHub issue tracker, with the op_CallIndirect issue (#547) closed as a duplicate of the op_SetSlot_i32 issue (#543). No significant broader media coverage or notable researcher commentary beyond the VulDB submission has been identified.