CVE-2025-62711

Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched to fix this issue. There are no workarounds.

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/bytecodealliance/wasmtime/commit/192f2fcdadfec9d0cf6b58548a85a7307450cbf5	Patch
https://github.com/bytecodealliance/wasmtime/pull/11592	Patch
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4h67-722j-5pmc	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*

History

01 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Wasmtime es un entorno de ejecución para WebAssembly. En las versiones desde la 38.0.0 hasta antes de la 38.0.3, la implementación de los trampolines de host a wasm relacionados con el modelo de componentes en Wasmtime contenía un error donde es posible diseñar cuidadosamente un componente que, cuando se llama de una manera específica, haría que el host fallara con un error de segmentación (segfault) o un fallo de aserción. Wasmtime 38.0.3 ha sido lanzado y está parcheado para solucionar este problema. No hay soluciones alternativas.

Information

Published : 2025-10-24 22:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-62711

Mitre link : CVE-2025-62711

CVE.ORG link : CVE-2025-62711

JSON object : View

Products Affected

bytecodealliance

wasmtime

CWE

CWE-755

Improper Handling of Exceptional Conditions

{"id": "CVE-2025-62711", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62711", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-27T15:22:12.743021Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "bytecodealliance", "product": "wasmtime", "versions": [{"status": "affected", "version": ">= 38.0.0, < 38.0.3"}]}]}], "published": "2025-10-24T22:15:49.850", "references": [{"url": "https://github.com/bytecodealliance/wasmtime/commit/192f2fcdadfec9d0cf6b58548a85a7307450cbf5", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/bytecodealliance/wasmtime/pull/11592", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4h67-722j-5pmc", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-755"}]}], "descriptions": [{"lang": "en", "value": "Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched to fix this issue. There are no workarounds."}, {"lang": "es", "value": "Wasmtime es un entorno de ejecuci\u00f3n para WebAssembly. En las versiones desde la 38.0.0 hasta antes de la 38.0.3, la implementaci\u00f3n de los trampolines de host a wasm relacionados con el modelo de componentes en Wasmtime conten\u00eda un error donde es posible dise\u00f1ar cuidadosamente un componente que, cuando se llama de una manera espec\u00edfica, har\u00eda que el host fallara con un error de segmentaci\u00f3n (segfault) o un fallo de aserci\u00f3n. Wasmtime 38.0.3 ha sido lanzado y est\u00e1 parcheado para solucionar este problema. No hay soluciones alternativas."}], "lastModified": "2026-10-08T11:10:00.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "5DA026E3-9952-4167-AB69-2D01247789E9", "versionEndExcluding": "38.0.3", "versionStartIncluding": "38.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}