{"id":"CVE-2025-66627","sourceIdentifier":"security-advisories@github.com","published":"2025-12-09T16:18:21.910","lastModified":"2026-10-14T21:10:00.183","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code execution. This issue is fixed in versions 0.41.2, 0.47.1, 0.51.3 and 1.0.1. To workaround this issue, consider limiting the maximum linear memory sizes where feasible."},{"lang":"es","value":"Wasmi es un intérprete de WebAssembly enfocado en sistemas restringidos y embebidos. En las versiones 0.41.0, 0.41.1, 0.42.0 hasta la 0.47.1, 0.50.0 hasta la 0.51.2 y 1.0.0, la implementación de memoria lineal de Wasmi conduce a una vulnerabilidad de Use After Free, activada por un módulo WebAssembly bajo ciertas condiciones de crecimiento de memoria. Este problema puede conducir potencialmente a corrupción de memoria, revelación de información o ejecución de código. Este problema está solucionado en las versiones 0.41.2, 0.47.1, 0.51.3 y 1.0.1. Como solución alternativa a este problema, considere limitar los tamaños máximos de memoria lineal donde sea factible."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"wasmi-labs","product":"wasmi","versions":[{"version":">= 0.41.0, < 0.41.2","status":"affected"},{"version":">= 0.42.0, < 0.47.1","status":"affected"},{"version":">= 0.50.0, < 0.51.3","status":"affected"},{"version":">= 1.0.0, < 1.0.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-09T15:21:08.509833Z","id":"CVE-2025-66627","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wasmi-labs:wasmi:*:*:*:*:*:rust:*:*","versionStartIncluding":"0.41.0","versionEndExcluding":"0.41.2","matchCriteriaId":"DEC38241-42E1-416E-B258-4789ABCE4FAE"},{"vulnerable":true,"criteria":"cpe:2.3:a:wasmi-labs:wasmi:*:*:*:*:*:rust:*:*","versionStartIncluding":"0.47.0","versionEndExcluding":"0.47.1","matchCriteriaId":"1FF46E2B-0D1F-4875-8829-15A4B0F18337"},{"vulnerable":true,"criteria":"cpe:2.3:a:wasmi-labs:wasmi:*:*:*:*:*:rust:*:*","versionStartIncluding":"0.51.0","versionEndExcluding":"0.51.3","matchCriteriaId":"3DD06F35-DCE6-436A-82E6-8ABFB27F882A"},{"vulnerable":true,"criteria":"cpe:2.3:a:wasmi-labs:wasmi:1.0.0:*:*:*:*:rust:*:*","matchCriteriaId":"0C5B18F1-7C31-4A15-8A6B-FA4C4F2E8E6B"}]}]}],"references":[{"url":"https://github.com/wasmi-labs/wasmi/security/advisories/GHSA-g4v2-cjqp-rfmq","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}