{"id":"CVE-2025-66627","aliases":["EUVD-2025-201826","GHSA-g4v2-cjqp-rfmq"],"status":"published","title":"Wasmi's Linear Memory has a Critical Use After Free Vulnerability","description":"Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code execution. This issue is fixed in versions 0.41.2, 0.47.1, 0.51.3 and 1.0.1. To workaround this issue, consider limiting the maximum linear memory sizes where feasible.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00157,"percentile":0.04855,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2025-12-08T22:15:49Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"crates.io","package":"wasmi","fixed_in":["0.41.2","0.47.1","0.51.3","1.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"wasmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.41.0"},{"fixed":"0.41.2"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"wasmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.42.0"},{"fixed":"0.47.1"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"wasmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.50.0"},{"fixed":"0.51.3"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"wasmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"wasmi","ranges":[{"type":"SEMVER","events":[{"introduced":"0.41.0"},{"fixed":"0.41.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"wasmi","ranges":[{"type":"SEMVER","events":[{"introduced":"0.42.0"},{"fixed":"0.47.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"wasmi","ranges":[{"type":"SEMVER","events":[{"introduced":"0.50.0"},{"fixed":"0.51.3"}]}]},{"source":"osv","ecosystem":"crates.io","package":"wasmi","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}]}],"products":[{"vendor":"wasmi-labs","product":"wasmi"}],"references":[{"url":"https://github.com/wasmi-labs/wasmi/security/advisories/GHSA-g4v2-cjqp-rfmq","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/wasmi-labs/wasmi/commit/0e6f0d2a8325602c58d6a53ce1c0e6045eb6a490","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66627","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g4v2-cjqp-rfmq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66627.json","tags":["advisory"]},{"url":"https://github.com/wasmi-labs/wasmi","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-66627","title":"Wasmi's Linear Memory has a Critical Use After Free Vulnerability","description":"Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code execution. This issue is fixed in versions 0.41.2, 0.47.1, 0.51.3 and 1.0.1. To workaround this issue, consider limiting the maximum linear memory sizes where feasible.","status":"published","published":"2025-12-09T02:52:46.938Z","modified":"2025-12-09T15:21:18.048Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:32:53.157279Z"}],"euvd":[{"id":"EUVD-2025-201826","description":"Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code execution. This issue is fixed in versions 0.41.2, 0.47.1, 0.51.3 and 1.0.1. To workaround this issue, consider limiting the maximum linear memory sizes where feasible.","status":"published","published":"2025-12-09T02:52:46Z","modified":"2025-12-09T15:21:18Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:08.049254Z"}],"ghsa":[{"id":"GHSA-g4v2-cjqp-rfmq","title":"Critical Use-After-Free in Wasmi's Linear Memory","description":"### Summary\n\nA use-after-free vulnerability has been discovered in the linear memory implementation of Wasmi. This issue can be triggered by a WebAssembly module under certain memory growth conditions, potentially leading to memory corruption, information disclosure, or code execution.\n\n### Impact\n\n- **Confidentiality:** High – attacker-controlled memory reads possible.\n- **Integrity:** High – memory corruption may allow arbitrary writes.\n- **Availability:** High – interpreter crashes possible.\n\n### Affected Versions\n\nWasmi `v0.41.0` through Wasmi `v1.0.0`.\n\n### Workarounds\n\n- Upgrade to the latest patched version of Wasmi.\n- Consider limiting the maximum linear memory sizes where feasible.\n\n### Credits\n\nThis vulnerability was discovered by **Robert T. Morris (RTM)**.","status":"published","published":"2025-12-08T22:15:49Z","modified":"2025-12-09T19:17:36Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:39:12.222121Z"}],"nvd":[{"id":"CVE-2025-66627","description":"Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code execution. This issue is fixed in versions 0.41.2, 0.47.1, 0.51.3 and 1.0.1. To workaround this issue, consider limiting the maximum linear memory sizes where feasible.","status":"published","published":"2025-12-09T16:18:21.91Z","modified":"2026-10-14T21:10:00.183Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:11:49.468427Z"}],"osv":[{"id":"CVE-2025-66627","title":"Wasmi's Linear Memory has a Critical Use After Free Vulnerability","description":"Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code execution. This issue is fixed in versions 0.41.2, 0.47.1, 0.51.3 and 1.0.1. To workaround this issue, consider limiting the maximum linear memory sizes where feasible.","status":"published","published":"2025-12-09T02:52:46.938Z","modified":"2026-10-28T02:30:35.310953365Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:44:52.202386Z"},{"id":"GHSA-g4v2-cjqp-rfmq","title":"Critical Use-After-Free in Wasmi's Linear Memory","description":"### Summary\n\nA use-after-free vulnerability has been discovered in the linear memory implementation of Wasmi. This issue can be triggered by a WebAssembly module under certain memory growth conditions, potentially leading to memory corruption, information disclosure, or code execution.\n\n### Impact\n\n- **Confidentiality:** High – attacker-controlled memory reads possible.\n- **Integrity:** High – memory corruption may allow arbitrary writes.\n- **Availability:** High – interpreter crashes possible.\n\n### Affected Versions\n\nWasmi `v0.41.0` through Wasmi `v1.0.0`.\n\n### Workarounds\n\n- Upgrade to the latest patched version of Wasmi.\n- Consider limiting the maximum linear memory sizes where feasible.\n\n### Credits\n\nThis vulnerability was discovered by **Robert T. Morris (RTM)**.","status":"published","published":"2025-12-08T22:15:49Z","modified":"2026-09-10T03:50:31.9529507Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:46:47.119724Z"}]}}