PT-2025-30073 · Bytecode Alliance+1 · Wasmtime+1

Hatoo · Published 2025-07-18 · Updated 2025-11-04 · CVE-2025-53901

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Wasmtime versions 24.0.0 through 24.0.3 Wasmtime versions 33.0.0 through 33.0.1 Wasmtime versions 34.0.0 through 34.0.1

Description Wasmtime is a runtime for WebAssembly. A bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host (embedder). The issue is triggered by calling path open after calling fd renumber with either two equal argument values or a second argument being equal to a previously-closed file descriptor number value. The resulting corrupt state leads to a panic when opening a file descriptor. This panic is considered a denial-of-service vector for WebAssembly embedders. This bug does not affect WASIp2 and embedders using components.

Recommendations Update to Wasmtime version 24.0.4. Update to Wasmtime version 33.0.2. Update to Wasmtime version 34.0.2.

Exploit

Fix

DoS

Weakness Enumeration

CWE-672

Related Identifiers

CVE-2025-53901

GHSA-FM79-3F68-H2FC

OPENSUSE-SU-2025:15398-1

OPENSUSE-SU-2025:15704-1

RUSTSEC-2025-0046

Affected Products

Debian

Wasmtime

References · 29

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53901.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-53901 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fm79-3f68-h2fc · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15704-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53901 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-53901 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-53901 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-53901 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-53901 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15398-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-53901 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2025-0046 · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime · Note
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-fm79-3f68-h2fc · Note
• https://github.com/bytecodealliance/wasmtime/blob/037a6edadbc225decbea00a551aabf04203717d9/crates/wasi/src/preview1.rs#L1824-L1836 · Note