CVE-2025-66627 - CVE House
Back to Database
Status published High CVE-2025-66627

Wasmi's Linear Memory has a Critical Use After Free Vulnerability

Vulnerability Description

Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code execution. This issue is fixed in versions 0.41.2, 0.47.1, 0.51.3 and 1.0.1. To workaround this issue, consider limiting the maximum linear memory sizes where feasible.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66627

Credits & Attribution

No credits recorded in the NVD database.

References

More from wasmi-labs

View All →
CVE-2024-28123
Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters
High 7.3

Affected Vendor

Affected Software

wasmi
Vulnerable Versions:
>= 0.41.0, < 0.41.2, >= 0.42.0, < 0.47.1, >= 0.50.0, < 0.51.3, >= 1.0.0, < 1.0.1

Timeline

Official Publish: December 9th, 2025
Last Modified: December 9th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-416

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control
T1485 Data Destruction
Impact