CVE-2025-66627
Critical Use-After-Free in Wasmi's Linear Memory
Impact
### Summary A use-after-free vulnerability has been discovered in the linear memory implementation of Wasmi. This issue can be triggered by a WebAssembly module under certain memory growth conditions, potentially leading to memory corruption, information disclosure, or code execution. ### Impact - **Confidentiality:** High – attacker-controlled memory reads possible. - **Integrity:** High – memory corruption may allow arbitrary writes. - **Availability:** High – interpreter crashes possible. ### Affected Versions Wasmi `v0.41.0` through Wasmi `v1.0.0`. ### Workarounds - Upgrade to the latest patched version of Wasmi. - Consider limiting the maximum linear memory sizes where feasible. ### Credits This vulnerability was discovered by **Robert T. Morris (RTM)**.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | wasmi | >= 0.41.0, < 0.41.2 | 0.41.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wasmi-Labs | Wasmi | from 0.41.0 before 0.41.2 from 0.47.0 before 0.47.1 from 0.51.0 before 0.51.3 Version 1.0.0 |