PT-2025-49777 · Wasmi · Wasmi

Published 2025-12-08 · Updated 2025-12-09 · CVE-2025-66627

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wasmi versions 0.41.0 through 0.41.1 Wasmi versions 0.42.0 through 0.47.1 Wasmi versions 0.50.0 through 0.51.2 Wasmi version 1.0.0

Description Wasmi is a WebAssembly interpreter designed for constrained and embedded systems. The linear memory implementation in affected versions contains a Use After Free condition. This issue is triggered when a WebAssembly module operates under specific memory growth circumstances. Successful exploitation could result in memory corruption, information disclosure, or code execution.

Recommendations Versions prior to 0.41.2 are affected. Versions prior to 0.47.2 are affected. Versions prior to 0.51.3 are affected. Versions prior to 1.0.1 are affected. Consider limiting the maximum linear memory sizes where feasible.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2025-66627

GHSA-G4V2-CJQP-RFMQ

Affected Products

Wasmi

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66627.json · Exploit
• https://github.com/wasmi-labs/wasmi/security/advisories/GHSA-g4v2-cjqp-rfmq · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g4v2-cjqp-rfmq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66627 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66627 · Security Note
• https://github.com/wasmi-labs/wasmi/commit/0e6f0d2a8325602c58d6a53ce1c0e6045eb6a490 · Note
• https://github.com/wasmi-labs/wasmi · Note
• https://t.me/CVEtracker/39204 · Telegram Post
• https://twitter.com/CVEnew/status/1998355389637968166 · Twitter Post