Wasmi's Linear Memory has a Critical Use After Free Vulnerability
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-416 and the CVSS impact.
Summary
Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code execution. This issue is fixed in versions 0.41.2, 0.47.1, 0.51.3 and 1.0.1. To workaround this issue, consider limiting the maximum linear memory sizes where feasible.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wasmi-labs | wasmi | 0.41.0 to before 0.41.2; 0.42.0 to before 0.47.1; 0.50.0 to before 0.51.3; 1.0.0 to before 1.0.1 | 0.41.2, 0.47.1, 0.51.3, 1.0.1 | Patch available | CNA |
| — | wasmi (crates.io) | 0.41.0 to before 0.41.2 | 0.41.2 | Patch available | GHSA-g4v2-cjqp-rfmq |
| — | wasmi (crates.io) | 0.42.0 to before 0.47.1 | 0.47.1 | Patch available | GHSA-g4v2-cjqp-rfmq |
| — | wasmi (crates.io) | 0.50.0 to before 0.51.3 | 0.51.3 | Patch available | GHSA-g4v2-cjqp-rfmq |
| — | wasmi (crates.io) | 1.0.0 to before 1.0.1 | 1.0.1 | Patch available | GHSA-g4v2-cjqp-rfmq |
- wasmi Vendorwasmi-labs Affected 0.41.0 to before 0.41.2; 0.42.0 to before 0.47.1; 0.50.0 to before 0.51.3; 1.0.0 to before 1.0.1 Fixed in 0.41.2, 0.47.1, 0.51.3, 1.0.1 Patch available CNA
- wasmi (crates.io) Vendor— Affected 0.41.0 to before 0.41.2 Fixed in 0.41.2 Patch available GHSA-g4v2-cjqp-rfmq
- wasmi (crates.io) Vendor— Affected 0.42.0 to before 0.47.1 Fixed in 0.47.1 Patch available GHSA-g4v2-cjqp-rfmq
- wasmi (crates.io) Vendor— Affected 0.50.0 to before 0.51.3 Fixed in 0.51.3 Patch available GHSA-g4v2-cjqp-rfmq
- wasmi (crates.io) Vendor— Affected 1.0.0 to before 1.0.1 Fixed in 1.0.1 Patch available GHSA-g4v2-cjqp-rfmq
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wasmi-labs:wasmi:*:*:*:*:*:rust:*:* | 0.41.0 to before 0.41.2; 0.47.0 to before 0.47.1; 0.51.0 to before 0.51.3 | Vulnerable | wasmi-labs |
| cpe:2.3:a:wasmi-labs:wasmi:1.0.0:*:*:*:*:rust:*:* | 1.0.0 | Vulnerable | wasmi-labs |
- cpe:2.3:a:wasmi-labs:wasmi:*:*:*:*:*:rust:*:* Versions 0.41.0 to before 0.41.2; 0.47.0 to before 0.47.1; 0.51.0 to before 0.51.3 Vulnerable ·wasmi-labs
- cpe:2.3:a:wasmi-labs:wasmi:1.0.0:*:*:*:*:rust:*:* Versions 1.0.0 Vulnerable ·wasmi-labs
Remediation
- Fix · CNA wasmi (wasmi-labs) Fixed in 0.41.2, 0.47.1, 0.51.3, 1.0.1
- Fix · GHSA-g4v2-cjqp-rfmq wasmi (crates.io) Fixed in 0.41.2 Advisory →
- Fix · GHSA-g4v2-cjqp-rfmq wasmi (crates.io) Fixed in 0.47.1 Advisory →
- Fix · GHSA-g4v2-cjqp-rfmq wasmi (crates.io) Fixed in 0.51.3 Advisory →
- Fix · GHSA-g4v2-cjqp-rfmq wasmi (crates.io) Fixed in 1.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-66627
- 2026-10-03 Alias added: GHSA-g4v2-cjqp-rfmq
References
More wasmi-labs Wasmi vulnerabilities
- TI-2024-18703 Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-66627 · CVE Program
- CVE-2025-66627 · NVD
- FIRST EPSS
- GHSA-g4v2-cjqp-rfmq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences