CVE-2025-15572: Wasm3 Information Disclosure Vulnerability

CVE-2025-15572 Overview

A memory leak vulnerability has been identified in wasm3, the fast WebAssembly interpreter, affecting versions up to 0.5.0. The vulnerability exists within the NewCodePage function, where improper memory management leads to memory resources not being properly released. This vulnerability requires local access to exploit and could lead to resource exhaustion over time, potentially causing denial of service conditions in applications utilizing the wasm3 runtime.

Critical Impact

Local attackers with access to systems running affected wasm3 versions can trigger memory leaks through the NewCodePage function, potentially leading to system instability and denial of service through memory exhaustion.

Affected Products

• wasm3 versions up to and including 0.5.0
• Applications embedding the wasm3 WebAssembly interpreter
• Systems running wasm3-based WebAssembly runtimes

Discovery Timeline

• 2026-02-10 - CVE-2025-15572 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2025-15572

Vulnerability Analysis

This vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), a memory management flaw that occurs when allocated memory is not properly freed after use. In the context of wasm3, the NewCodePage function fails to release allocated memory under certain conditions, causing a gradual accumulation of unreleased memory blocks.

The wasm3 interpreter is designed to be a lightweight, portable WebAssembly runtime suitable for embedded systems and resource-constrained environments. Memory leaks in such contexts are particularly impactful as they can quickly exhaust limited system resources.

The exploit has been publicly disclosed and proof-of-concept materials are available, though the project currently lacks active maintenance, which complicates remediation efforts.

Root Cause

The root cause lies in the NewCodePage function's memory allocation logic, where certain code paths fail to properly deallocate memory when errors occur or when code pages are no longer needed. This results in orphaned memory blocks that accumulate over the interpreter's lifetime.

CWE-401 vulnerabilities typically arise from:

• Missing deallocation calls in error handling paths
• Lost references to allocated memory blocks
• Incomplete cleanup during object destruction

Attack Vector

The attack requires local access to the target system. An attacker must be able to execute or provide WebAssembly modules to an application using the vulnerable wasm3 interpreter. By repeatedly triggering the vulnerable code path in NewCodePage, an attacker can cause progressive memory exhaustion.

The vulnerability manifests during WebAssembly module processing when the interpreter allocates new code pages. Technical details and reproduction steps can be found in the GitHub Issue Discussion and the PoC Repository.

Detection Methods for CVE-2025-15572

Indicators of Compromise

• Gradual increase in memory consumption of processes using wasm3 without corresponding workload increase
• System logs indicating memory allocation failures in wasm3-dependent applications
• Unexpected process termination due to out-of-memory conditions
• Memory profiler output showing unreleased allocations in NewCodePage or related functions

Detection Strategies

• Monitor memory usage patterns of applications embedding wasm3 for abnormal growth trends
• Implement memory profiling in development and staging environments using tools like Valgrind or AddressSanitizer
• Review application logs for memory-related warnings or errors from wasm3 components
• Deploy runtime memory monitoring for production systems running wasm3-based applications

Monitoring Recommendations

• Configure alerting thresholds for memory utilization in systems running wasm3-dependent applications
• Implement periodic memory usage reporting for long-running processes using the affected interpreter
• Track and correlate WebAssembly module loading events with memory allocation patterns
• Establish baseline memory profiles for normal operation to facilitate anomaly detection

How to Mitigate CVE-2025-15572

Immediate Actions Required

• Audit systems to identify applications using wasm3 version 0.5.0 or earlier
• Evaluate the criticality of affected deployments and prioritize remediation based on exposure
• Consider replacing wasm3 with actively maintained WebAssembly runtimes if security patches are unavailable
• Implement resource limits and memory quotas for processes running wasm3 to contain potential impact

Patch Information

Unfortunately, the wasm3 project currently has no active maintainer, which may delay or prevent the availability of official patches. Users should monitor the wasm3 GitHub repository for any community-contributed fixes or project status updates.

For detailed vulnerability tracking information, refer to VulDB #344934.

Workarounds

• Implement process-level memory limits using operating system controls (cgroups, ulimit) to prevent system-wide impact
• Schedule periodic restarts of long-running wasm3-dependent processes to clear accumulated memory leaks
• Consider containerization of affected applications to isolate memory consumption
• Evaluate migration to alternative WebAssembly runtimes with active security maintenance

# Example: Set memory limits for wasm3-dependent processes using systemd
# Add to service unit file [Service] section
MemoryMax=512M
MemoryHigh=400M

# Or using cgroups directly
echo 536870912 > /sys/fs/cgroup/memory/wasm3-app/memory.limit_in_bytes