WebAssembly Memory Interaction Issue in Wasmtime by Bytecode Alliance
CVE-2025-64345
1.8LOW
What is CVE-2025-64345?
Wasmtime, a WebAssembly runtime, is vulnerable due to an unsound interaction in its Rust embedder API prior to specified versions. This flaw allows shared linear memory to be misinterpreted, potentially leading to unsafe parallel modifications and data races. Versions 24.0.5, 36.0.3, 37.0.3, and 38.0.4 have been patched to prevent the creation of shared memories via Memory::new, mandating the use of SharedMemory::new instead. For those unable to upgrade, disabling core dumps is recommended as a temporary workaround.
Affected Version(s)
wasmtime >= 38.0.1, < 38.0.4 < 38.0.1, 38.0.4
wasmtime >= 37.0.0, < 37.0.3 < 37.0.0, 37.0.3
wasmtime >= 26.0.0, < 36.0.3 < 26.0.0, 36.0.3