PT-2025-43676 · Wasmtime · Wasmtime

Published 2025-07-18 · Updated 2025-10-29 · CVE-2025-62711

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Wasmtime versions 38.0.0 through 38.0.2

Description Wasmtime is a runtime for WebAssembly. Versions from 38.0.0 through 38.0.2 contain a flaw in the implementation of component-model related host-to-wasm trampolines. Specifically, a carefully crafted component, when called in a specific way, can cause the host to crash with a segmentation fault or assertion failure.

Recommendations Update to version 38.0.3 or later.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2025-62711

GHSA-4H67-722J-5PMC

RUSTSEC-2025-0112

Affected Products

Wasmtime

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62711.json · Exploit
• https://github.com/bytecodealliance/wasmtime/commit/192f2fcdadfec9d0cf6b58548a85a7307450cbf5 · Patch
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4h67-722j-5pmc · Patch
• https://github.com/bytecodealliance/wasmtime/pull/11592 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-62711 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-62711 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-62711 · Security Note
• https://ubuntu.com/security/CVE-2025-62711 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62711 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2025-0112 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4h67-722j-5pmc · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime · Note
• https://crates.io/crates/wasmtime · Note
• https://reddit.com/r/VulnMatter/comments/1oj4i5j/resumen_diario_de_vulnerabilidades_29102025 · Reddit Post
• https://t.me/cveNotify/140315 · Telegram Post