CVE-2025-66627
Wasmi is a WebAssembly interpreter focused on constrained and embedded systems.
Published Dec 9, 2025 · updated Oct 14, 2026 · wasmi-labs wasmi
Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code execution. This issue is fixed in versions 0.41.2, 0.47.1, 0.51.3 and 1.0.1. To workaround this issue, consider limiting the maximum linear memory sizes where feasible.
Timeline
Detection, updates, and resolution for this record.
Dec 9, 2025 · NIST NVD
Detected
Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code e
Oct 14, 2026 · NIST NVD
Updated
Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code e
Affected
- cpe wasmi-labs/wasmiversion unspecified
- cpe wasmi-labs/wasmi1.0.0
Sources
- CVE.orgCVE-2025-66627
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-66627
30-day exploitation probability 0.1%
first.org - NIST NVDCVE-2025-66627
Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module unde
nvd.nist.gov