CVE-2025-15572
📋 TL;DR
A memory leak vulnerability exists in wasm3 WebAssembly interpreter versions up to 0.5.0 in the NewCodePage function. This allows local attackers to gradually exhaust system memory, potentially causing denial of service. The vulnerability affects systems running wasm3 with untrusted WebAssembly code execution.
💻 Affected Systems
- wasm3 WebAssembly interpreter
📦 What is this software?
Wasm3 by Wasm3 Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system memory exhaustion leading to denial of service, application crashes, and potential system instability affecting other services.
Likely Case
Gradual memory consumption causing performance degradation and eventual application crashes in affected wasm3 instances.
If Mitigated
Minimal impact if proper memory limits and monitoring are in place, with only isolated application crashes.
🎯 Exploit Status
Proof of concept available in GitHub repository. Exploitation requires ability to execute WebAssembly code locally. Project currently has no active maintainer.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None - project has no active maintainer
Vendor Advisory: https://github.com/wasm3/wasm3/issues/550
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative WebAssembly runtimes or implementing workarounds.
🔧 Temporary Workarounds
Memory usage monitoring and limits
allImplement memory usage monitoring and hard limits for wasm3 processes to prevent complete memory exhaustion
Use ulimit -v [memory_limit_in_kb] for Linux systems
Implement container memory limits for Docker deployments
Restrict WebAssembly code execution
allOnly allow execution of trusted, verified WebAssembly code in wasm3 environments
🧯 If You Can't Patch
- Isolate wasm3 instances in containers with strict memory limits
- Implement aggressive monitoring and alerting for abnormal memory consumption patterns
- Consider migrating to maintained WebAssembly runtimes like Wasmtime or WAMR
🔍 How to Verify
Check if Vulnerable:
Check wasm3 version: if version is 0.5.0 or earlier, system is vulnerable. Test with provided PoC from GitHub repository.Check Version:
wasm3 --version or check build/installation documentation for version informationVerify Fix Applied:
No official fix available. Verify workarounds by testing memory consumption with malicious WebAssembly code.📡 Detection & Monitoring
Log Indicators:
- Abnormal memory consumption patterns in wasm3 processes
- Application crashes with out-of-memory errors
- Repeated WebAssembly module loading failures
Network Indicators:
- None - local vulnerability only
SIEM Query:
Process memory usage > threshold AND process_name contains 'wasm3'