Vulnerability · Published Dec 9, 2025 · Assigned by GitHub_M

CVE-2025-66627Wasmi's Linear Memory has a Critical Use After Free Vulnerability

High 8.4

In plain English

A high-severity use-after-free in wasmi from wasmi-labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)0.1%top 96.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code execution. This issue is fixed in versions 0.41.2, 0.47.1, 0.51.3 and 1.0.1. To workaround this issue, consider limiting the maximum linear memory sizes where feasible.

Affected products (as reported)

Vendor	Product	Versions
wasmi-labs	wasmi	>= 0.41.0, < 0.41.2>= 0.42.0, < 0.47.1>= 0.50.0, < 0.51.3>= 1.0.0, < 1.0.1

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/wasmi-labs/wasmi/security/advisories/GHSA-g4v2-cjqp-rfmq x_refsource_CONFIRM