{"id":"EUVD-2025-35897","enisaUuid":"5f6b8277-a297-3671-8511-67622282358a","description":"Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it\u0027s possible to carefully craft a component, which when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched to fix this issue. There are no workarounds.","datePublished":"Oct 24, 2025, 9:54:52 PM","dateUpdated":"Oct 27, 2025, 3:22:22 PM","baseScore":2.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4h67-722j-5pmc\nhttps://github.com/bytecodealliance/wasmtime/pull/11592\nhttps://github.com/bytecodealliance/wasmtime/commit/192f2fcdadfec9d0cf6b58548a85a7307450cbf5\n","aliases":"CVE-2025-62711\nGHSA-4h67-722j-5pmc\n","assigner":"GitHub_M","epss":0.41,"enisaIdProduct":[{"id":"37e96b40-aa04-3df2-814f-5e3aeb11084f","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"38.0.0, \u003c 38.0.3"}],"enisaIdVendor":[{"id":"0dc15eb2-a560-36f6-bfd1-2921a1ac5863","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"1fb143ef-b03a-3ecb-aafb-3fa82bbcc6c9","vulnerability":{"id":"GHSA-4h67-722j-5pmc","description":"Wasmtime vulnerable to segfault when using component resources","datePublished":"Oct 27, 2025, 8:18:01 PM","dateUpdated":"Oct 27, 2025, 8:18:01 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4h67-722j-5pmc\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-62711\nhttps://github.com/bytecodealliance/wasmtime/pull/11592\nhttps://github.com/bytecodealliance/wasmtime/commit/192f2fcdadfec9d0cf6b58548a85a7307450cbf5\nhttps://github.com/bytecodealliance/wasmtime\nhttps://rustsec.org/advisories/RUSTSEC-2025-0112.html\n","enisa_id":"EUVD-2025-35897\n","aliases":"CVE-2025-62711\nGHSA-4h67-722j-5pmc\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a2e61d3f-9217-3d15-8ccf-b5f6b1e760fb","vulnerability":{"id":"CVE-2025-62711","description":"Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it\u0027s possible to carefully craft a component, which when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched to fix this issue. There are no workarounds.","datePublished":"Oct 24, 2025, 9:54:52 PM","dateUpdated":"Oct 27, 2025, 3:22:22 PM","status":"PUBLISHED","baseScore":2.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4h67-722j-5pmc\nhttps://github.com/bytecodealliance/wasmtime/pull/11592\nhttps://github.com/bytecodealliance/wasmtime/commit/192f2fcdadfec9d0cf6b58548a85a7307450cbf5\n","enisa_id":"EUVD-2025-35897\n","assigner":"GitHub_M","epss":0.41,"dataProcessed":"Nov 6, 2026, 7:20:53 AM","vulnerabilityProduct":[{"id":"5a75b002-143d-3626-bdd0-62f0fbd7c4cb","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"38.0.0, \u003c 38.0.3"}],"vulnerabilityVendor":[{"id":"d29a4a68-d195-3de9-a474-199902a1aaf7","vendor":{"name":"bytecodealliance"}}]}}],"enisaIdAdvisory":[]}