CVE-2025-66627

Wasmi's Linear Memory has a Critical Use After Free Vulnerability

State: Published
Severity: 8.4 High
Published: Dec 9, 2025
Updated: Dec 9, 2025
Reserved: Dec 5, 2025

Description

Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code execution. This issue is fixed in versions 0.41.2, 0.47.1, 0.51.3 and 1.0.1. To workaround this issue, consider limiting the maximum linear memory sizes where feasible.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
wasmiwasmi-labs	>= 0.41.0, < 0.41.2Affected >= 0.42.0, < 0.47.1Affected >= 0.50.0, < 0.51.3Affected >= 1.0.0, < 1.0.1Affected

References

https://github.com/wasmi-labs/wasmi/security/advisories/GHSA-g4v2-cjqp-rfmq

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.