CVE-2025-62711 Wasmtime vulnerable to segfault when using component resources
A crafted WebAssembly component can crash the Wasmtime host with a segfault, requiring an upgrade to the patched runtime version.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-62711?
CVE-2025-62711 is a low-severity denial of service vulnerability in bytecodealliance wasmtime, published on 24 Oct 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched to fix this issue. There are no workarounds.
Weakness: CWE-755
Which versions are affected by CVE-2025-62711?
3 open source packages ship an affected version, including wasmtime. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wasmtime crates.io | From 38.0.0 | 38.0.3 |
wasmtime crates.io | From 38.0.0 | 38.0.3 |
wasmtime crates.io | From 38.0.0 | 38.0.3 |
Products include Bytecodealliance Wasmtime.
How do I fix CVE-2025-62711?
Upgrade wasmtime to 38.0.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-62711 being exploited?
There is no known exploitation of CVE-2025-62711 in the wild and no public exploit code.
Other vulnerabilities in bytecodealliance wasmtime
- CVE-2026-34971 Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift
- CVE-2026-34987 Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access
- CVE-2022-39393 Wasmtime vulnerable to data leakage between instances in the pooling allocator
- CVE-2022-24791 Use after free in Wasmtime
- CVE-2026-47261 Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
Sources
Also known as GHSA-4h67-722j-5pmc, RUSTSEC-2025-0112, UBUNTU-CVE-2025-62711.