CVE-2025-15413

MEDIUM

wasm3 < 0.5.0 - Memory Corruption in op_SetSlot_i32/op_CallIndirect

Title source: llm
STIX 2.1

Description

A vulnerability was detected in wasm3 up to 0.5.0. Impacted is the function op_SetSlot_i32/op_CallIndirect of the file m3_exec.h. Performing a manipulation results in memory corruption. The attack needs to be approached locally. The exploit is now public and may be used. Unfortunately, the project has no active maintainer at the moment.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.339334
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.339334
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.719829
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.719831
Exploit, Issue Tracking issue-tracking
https://github.com/wasm3/wasm3/issues/543
Exploit, Issue Tracking exploit issue-tracking
https://github.com/wasm3/wasm3/issues/547

Scores

CVSS v3 5.3
EPSS 0.0004
EPSS Percentile 13.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-119 CWE-787
Status published
Products (1)
wasm3_project/wasm3 < 0.5.0
Published Jan 01, 2026
Tracked Since Feb 18, 2026