Use After Free Vulnerability in Wasmi WebAssembly Interpreter
CVE-2025-66627

8.4HIGH

Key Information:

Vendor

Wasmi-labs

Status
Wasmi
Vendor
CVE Published:
9 December 2025

What is CVE-2025-66627?

Wasmi, a WebAssembly interpreter optimized for constrained and embedded systems, contains a vulnerability arising from its linear memory implementation. This flaw can be exploited through specific WebAssembly modules under particular memory growth scenarios, potentially leading to severe consequences such as memory corruption, information disclosure, or unintended code execution. To mitigate the risk, it is advisable to limit the maximum allowable linear memory sizes where applicable. Versions 0.41.2, 0.47.1, 0.51.3, and 1.0.1 contain fixes for this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

wasmi >= 0.41.0, < 0.41.2 < 0.41.0, 0.41.2

wasmi >= 0.42.0, < 0.47.1 < 0.42.0, 0.47.1

wasmi >= 0.50.0, < 0.51.3 < 0.50.0, 0.51.3

References

https://github.com/wasmi-labs/wasmi/security/advisories/G...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.