CVE-2025-15572: 
NixOS vulnerability analysis and mitigation

CVE-2025-15572 is a memory leak vulnerability in the wasm3 WebAssembly interpreter, specifically in the NewCodePage function, which fails to release allocated memory upon encountering certain runtime errors. It affects wasm3 versions up to and including 0.5.0. The vulnerability was publicly disclosed in December 2025 and published to NVD in February 2026. It carries a CVSS v3.1 base score of 5.5 (Medium), reflecting a local attack vector with high availability impact (Feedly, wasm3 Issue #550).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-404 (Improper Resource Shutdown or Release). When wasm3 encounters a specific runtime error — specifically "Error: incorrect value count on stack" — the NewCodePage function allocates a large memory block (up to ~263 MB via calloc) for code page storage, but the error-handling path exits without freeing this allocation. A local attacker with low privileges can trigger this condition by supplying a crafted WebAssembly binary that induces the stack validation failure, causing the memory to remain leaked for the lifetime of the process. A proof-of-concept reproducer and ASAN report have been publicly disclosed (wasm3 Issue #550, PoC Repo).

Successful exploitation allows a local low-privileged attacker to cause significant memory exhaustion on the affected system, with a single triggering event leaking approximately 263–275 MB of heap memory. Repeated exploitation can rapidly exhaust available system memory, leading to application crashes, out-of-memory (OOM) conditions, and denial of service — particularly severe in embedded or long-running service deployments of wasm3. There is no impact on confidentiality or integrity; only availability is affected (wasm3 Issue #550, Feedly).

A public proof-of-concept exploit (a crafted WebAssembly binary reproducer) has been disclosed on GitHub and is referenced by NVD. The EPSS score is approximately 0.013% (0.000130), indicating low probability of widespread exploitation. There is no evidence of in-the-wild exploitation at this time, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The wasm3 project currently has no active maintainer, meaning no official patch is forthcoming (PoC Repo, wasm3 Issue #550, Feedly).

1. Craft a malicious WebAssembly binary: Create or obtain a .wasm file that triggers the "Error: incorrect value count on stack" runtime error in wasm3 upon execution (a public reproducer is available at the linked PoC repository).
2. Obtain local access: Gain local access to the target system with at least low-privilege credentials, as the attack vector is local.
3. Execute the payload: Run the crafted .wasm binary against the wasm3 interpreter: ./wasm3 repro (where repro is the malicious WebAssembly file).
4. Trigger the memory leak: The interpreter encounters the stack validation error, allocates ~263–275 MB via NewCodePage/calloc, then aborts without freeing the memory.
5. Repeat for DoS: Execute the payload repeatedly to progressively exhaust system memory, eventually causing OOM conditions, application crashes, or system instability (wasm3 Issue #550, PoC Repo).

• Process: The wasm3 process exhibiting rapidly growing resident set size (RSS) or virtual memory usage, particularly spikes of ~263 MB per invocation, observable via top, htop, or /proc/<pid>/status.
• Logs: System logs (e.g., /var/log/syslog, dmesg) showing OOM killer events targeting the wasm3 process or co-located services; wasm3 stderr output containing "Error - incorrect value count on stack" immediately before process termination.
• File System: Presence of the public PoC reproducer binary (repro) or similarly crafted .wasm files in user-accessible directories.
• System: Sudden drops in available system memory (free -m) correlated with wasm3 process invocations; repeated short-lived wasm3 process executions in process accounting logs (wasm3 Issue #550).

No official patch is available, as the wasm3 project currently has no active maintainer. Organizations should consider migrating to an actively maintained WebAssembly runtime alternative. As interim mitigations: restrict local access to systems running wasm3; implement OS-level memory limits (e.g., ulimit -v) on the wasm3 process to cap memory consumption; isolate wasm3 in sandboxed or containerized environments with restricted privileges and memory ceilings; and monitor for community-maintained forks or pull requests that may address this issue (wasm3 GitHub, Feedly).

The wasm3 project maintainer has noted in the repository README that the project has entered a "minimal maintenance phase" due to personal circumstances (displacement caused by the war in Ukraine), and that the maintainer will review and merge incoming pull requests but cannot develop new features. The vulnerability was reported via a GitHub issue by researcher "oneafter" in December 2025, with a detailed ASAN report and reproducer. Red Hat has tracked the CVE but no vendor patch or advisory has been issued (wasm3 GitHub, wasm3 Issue #550, Red Hat CVE).