CVE-2025-66627

Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code execution. This issue is fixed in versions 0.41.2, 0.47.1, 0.51.3 and 1.0.1. To workaround this issue, consider limiting the maximum linear memory sizes where feasible.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/wasmi-labs/wasmi/security/advisories/GHSA-g4v2-cjqp-rfmq	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:wasmi-labs:wasmi::::::rust::*
	cpe:2.3:a:wasmi-labs:wasmi::::::rust::*
	cpe:2.3:a:wasmi-labs:wasmi::::::rust::*
	cpe:2.3:a:wasmi-labs:wasmi:1.0.0:::::rust::

History

14 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Wasmi es un intérprete de WebAssembly enfocado en sistemas restringidos y embebidos. En las versiones 0.41.0, 0.41.1, 0.42.0 hasta la 0.47.1, 0.50.0 hasta la 0.51.2 y 1.0.0, la implementación de memoria lineal de Wasmi conduce a una vulnerabilidad de Use After Free, activada por un módulo WebAssembly bajo ciertas condiciones de crecimiento de memoria. Este problema puede conducir potencialmente a corrupción de memoria, revelación de información o ejecución de código. Este problema está solucionado en las versiones 0.41.2, 0.47.1, 0.51.3 y 1.0.1. Como solución alternativa a este problema, considere limitar los tamaños máximos de memoria lineal donde sea factible.

Information

Published : 2025-12-09 16:18

Updated : 2026-10-14 21:10

NVD link : CVE-2025-66627

Mitre link : CVE-2025-66627

CVE.ORG link : CVE-2025-66627

JSON object : View

Products Affected

wasmi-labs

wasmi

CWE

CWE-416

Use After Free

{"id": "CVE-2025-66627", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66627", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-09T15:21:08.509833Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "wasmi-labs", "product": "wasmi", "versions": [{"status": "affected", "version": ">= 0.41.0, < 0.41.2"}, {"status": "affected", "version": ">= 0.42.0, < 0.47.1"}, {"status": "affected", "version": ">= 0.50.0, < 0.51.3"}, {"status": "affected", "version": ">= 1.0.0, < 1.0.1"}]}]}], "published": "2025-12-09T16:18:21.910", "references": [{"url": "https://github.com/wasmi-labs/wasmi/security/advisories/GHSA-g4v2-cjqp-rfmq", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code execution. This issue is fixed in versions 0.41.2, 0.47.1, 0.51.3 and 1.0.1. To workaround this issue, consider limiting the maximum linear memory sizes where feasible."}, {"lang": "es", "value": "Wasmi es un int\u00e9rprete de WebAssembly enfocado en sistemas restringidos y embebidos. En las versiones 0.41.0, 0.41.1, 0.42.0 hasta la 0.47.1, 0.50.0 hasta la 0.51.2 y 1.0.0, la implementaci\u00f3n de memoria lineal de Wasmi conduce a una vulnerabilidad de Use After Free, activada por un m\u00f3dulo WebAssembly bajo ciertas condiciones de crecimiento de memoria. Este problema puede conducir potencialmente a corrupci\u00f3n de memoria, revelaci\u00f3n de informaci\u00f3n o ejecuci\u00f3n de c\u00f3digo. Este problema est\u00e1 solucionado en las versiones 0.41.2, 0.47.1, 0.51.3 y 1.0.1. Como soluci\u00f3n alternativa a este problema, considere limitar los tama\u00f1os m\u00e1ximos de memoria lineal donde sea factible."}], "lastModified": "2026-10-14T21:10:00.183", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wasmi-labs:wasmi:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "DEC38241-42E1-416E-B258-4789ABCE4FAE", "versionEndExcluding": "0.41.2", "versionStartIncluding": "0.41.0"}, {"criteria": "cpe:2.3:a:wasmi-labs:wasmi:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "1FF46E2B-0D1F-4875-8829-15A4B0F18337", "versionEndExcluding": "0.47.1", "versionStartIncluding": "0.47.0"}, {"criteria": "cpe:2.3:a:wasmi-labs:wasmi:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "3DD06F35-DCE6-436A-82E6-8ABFB27F882A", "versionEndExcluding": "0.51.3", "versionStartIncluding": "0.51.0"}, {"criteria": "cpe:2.3:a:wasmi-labs:wasmi:1.0.0:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "0C5B18F1-7C31-4A15-8A6B-FA4C4F2E8E6B"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}