Use After Free Vulnerability in Wasmi WebAssembly Interpreter
CVE-2025-66627
8.4HIGH
What is CVE-2025-66627?
Wasmi, a WebAssembly interpreter optimized for constrained and embedded systems, contains a vulnerability arising from its linear memory implementation. This flaw can be exploited through specific WebAssembly modules under particular memory growth scenarios, potentially leading to severe consequences such as memory corruption, information disclosure, or unintended code execution. To mitigate the risk, it is advisable to limit the maximum allowable linear memory sizes where applicable. Versions 0.41.2, 0.47.1, 0.51.3, and 1.0.1 contain fixes for this issue.
Affected Version(s)
wasmi >= 0.41.0, < 0.41.2 < 0.41.0, 0.41.2
wasmi >= 0.42.0, < 0.47.1 < 0.42.0, 0.47.1
wasmi >= 0.50.0, < 0.51.3 < 0.50.0, 0.51.3