CVE-2025-66627 Wasmi's Linear Memory has a Critical Use After Free Vulnerability

What is CVE-2025-66627?

CVE-2025-66627 is a high-severity use after free vulnerability in wasmi-labs wasmi, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code execution. This issue is fixed in versions 0.41.2, 0.47.1, 0.51.3 and 1.0.1. To workaround this issue, consider limiting the maximum linear memory sizes where feasible.

Weakness: CWE-416

Which versions are affected by CVE-2025-66627?

8 open source packages ship an affected version, including wasmi. It affects 1 product.

Products include Wasmi-Labs Wasmi.

How do I fix CVE-2025-66627?

Upgrade wasmi to a fixed version for your release line: 0.41.2, 0.47.1, 0.51.3 or 1.0.1.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2025-66627 being exploited?

There is no known exploitation of CVE-2025-66627 in the wild and no public exploit code.

Other vulnerabilities in wasmi-labs wasmi

• CVE-2024-28123 Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters High 7.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g4v2-cjqp-rfmq.