CVE-2025-61670

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-61670
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-61670.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-61670
Aliases
Published
2025-10-07T18:49:53Z
Modified
2026-10-28T11:00:14Z
Severity
  • 1.0 (Low) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L CVSS Calculator
Summary
Wasmtime has memory leak in C API with `externref` and `anyref` types
Details

Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the anyref or externref WebAssembly values. This is caused by a regression introduced during the development of 37.0.0 and all prior versions of Wasmtime are unaffected. If anyref or externref is not used in the C/C++ API then embeddings are also unaffected by the leaky behavior. The wasmtime Rust crate is unaffected by this leak.

Development of Wasmtime 37.0.0 included a refactoring in Rust of changing the old ManuallyRooted<T> type to a new OwnedRooted<T> type. This change was integrated into Wasmtime's C API but left the C API in a state which had memory leaks. Additionally the new ownership semantics around this type were not reflected into the C++ API, making it leak-prone. A short version of the change is that previously ManuallyRooted<T>, as the name implies, required manual calls to an "unroot" operation. If this was forgotten then the memory was still cleaned up when the wasmtime_store_t itself was destroyed eventually. Documentation of when to "unroot" was sparse and there were already situations prior to 37.0.0 where memory would be leaked until the store was destroyed anyway. All memory, though, was always bound by the store, and destroying the store would guarantee that there were no memory leaks.

In migrating to OwnedRooted<T> the usage of the type in Rust changed. A manual "unroot" operation is no longer required and it happens naturally as a destructor of the OwnedRooted<T> type in Rust itself. These new resource ownership semantics were not fully integrated into the preexisting semantics of the C/C++ APIs in Wasmtime. A crucial distinction of OwnedRooted<T> vs ManuallyRooted<T> is that the OwnedRooted<T> type allocates host memory outside of the store. This means that if an OwnedRooted<T> is leaked then destroying a store does not release this memory and it's a permanent memory leak on the host.

This led to a few distinct, but related, issues arising: A typo in the wasmtime_val_unroot function in the C API meant that it did not actually unroot anything. This meant that even if embedders faithfully call the function then memory will be leaked. If a host-defined function returned a wasmtime_{externref,anyref}_t value then the value was never unrooted. The C/C++ API no longer has access to the value and the Rust implementation did not unroot. This meant that any values returned this way were never unrooted. The goal of the C++ API of Wasmtime is to encode automatic memory management in the type system, but the C++ API was not updated when OwnedRooted<T> was added. This meant that idiomatic usage of the C++ API would leak memory due to a lack of destructors on values.

These issues have all been fixed in a 37.0.2 release of Wasmtime. The implementation of the C and C++ APIs have been updated accordingly and respectively to account for the changes of ownership here. For example wasmtime_val_unroot has been fixed to unroot, the Rust-side implementation of calling an embedder-defined function will unroot return values, and the C++ API now has destructors on the ExternRef, AnyRef, and Val types. These changes have been made to the 37.0.x release branch in a non-API-breaking fashion. Changes to the 38.0.0 release branch (and main in the Wasmtime repository) include minor API updates to better accommodate the API semantic changes. The only known workaround at this time is to avoid using externref and anyref in the C/C++ API of Wasmtime. If avoiding those types is not possible then it's required for users to update to mitigate the leak issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-772"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61670.json"
}
References

Affected packages

Git / github.com/bytecodealliance/wasmtime

Affected ranges

Type
GIT
Repo
https://github.com/bytecodealliance/wasmtime
Events
Introduced
7b3d6ae79e9153a2477668062f5622c10333925f
Fixed
7a95dd3259f40707966445e9c32d8e1a3bf9b326
Fixed
adff9d9d0f09569203709d5687e5a7dc8e1ad0a3
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "37.0.0"
                },
                {
                    "fixed": "37.0.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "adff9d9d0f09569203709d5687e5a7dc8e1ad0a3"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v37.0.2",
            "range": [
                {
                    "fixed": "7a95dd3259f40707966445e9c32d8e1a3bf9b326"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

37.*
37.0.0
37.0.1
v37.*
v37.0.0
v37.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-61670.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "239038250953443979776037684010123981118",
            "length": 623
        },
        "id": "CVE-2025-61670-0a94ea56",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/linking.c",
            "function": "read_wat_file"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "1539636071088475761271501389735690170",
                "202280017842886777161336071364430178759",
                "245420630537766729263589258523551359799",
                "121922619957923171701000727503082051617",
                "117606466560574167169502258684100076027",
                "273927136556547083894740994943530651046",
                "326347702878535458112167853011593939333",
                "177943905407205378835001382241058416108",
                "195725604853579818220660413879530718418",
                "73381601307961683122498160152921845957",
                "22407344896013257401274119309773115248",
                "246958202002346833618572286861129460670",
                "268362116943033474798921688332187156051",
                "144629046543482296879011637992510624628",
                "79307799226460247638321950031163039757",
                "34160796396154798055588914820779950312",
                "110269825477982384747082875521711477014",
                "133359771295494434113385502098957970101",
                "295685618337758413568784100524640709756",
                "183608819447028077018588748184091393768",
                "58090359573668769466372093203111201591",
                "151666790149815128475758143498495510235",
                "170140036214424582401685727262750337687",
                "168396023086393001437003535517460338399",
                "51402073927974074500325167490137088941",
                "208933156753303184343878060010039307693",
                "287323649330925776894222205700521391632",
                "193818306674907620129557046567249454358",
                "130848518871737478987876835701279045086",
                "231830920624747344374247116056988707177",
                "99437803915501699995806951919063377226",
                "302102692915384062550529652336090956457",
                "71608320222380317626208701344350246070",
                "192608625071767999180454164960543331894",
                "315727110438839264717263120064566020320",
                "60439935921873870870160738336591664959",
                "97697815921122475283825954234583488237",
                "137755720758885462451019669273482012507",
                "202007932815018339842238699521202760726",
                "118073576258846537018657328685882213729",
                "37200871060491150511332459273724466025",
                "124482216885936197082003902494948658490",
                "106729139459858681163232615887539465263",
                "48951169713339684931934382079166698760",
                "287874011444583552840204929381141828619",
                "127274861278382954655432875173660055196",
                "5180740105952222281683202050628666728",
                "138616980595684969351541715496611687059",
                "29306367623286198976955350474624614771",
                "171524987274869128991859411480127468940",
                "250304328789518460913283973034958300828",
                "158473435543375922717220027213356072712",
                "242130368924215313304020373683716910219",
                "144350394220423014066568618444887168237",
                "196575107834987647605937848654150052244",
                "101762382403458101772126373533809643005",
                "185661521158047459238714116007834150492",
                "93453456329994913049942789669454462677",
                "73835743055820428817273873502255413799",
                "270834612007571598164451880362591954289",
                "10033196504580886054916381611960841204"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-126a2a64",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/include/wasmtime/val.hh"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "3386366889517654830900757931282440789",
            "length": 1856
        },
        "id": "CVE-2025-61670-13e3d56a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/tests/component/call_func.cc",
            "function": "TEST"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "281636230982690574565996862181999270078",
                "55998348253461067977918164250936377167",
                "87615399329177124453644051340795360391",
                "177469211927663071480343211343627645348",
                "303496817182978929185209101407752899742",
                "117320827620453740261762747723104282334",
                "211288138567783224172120535917590431813",
                "283382335213161466236018024834531103411",
                "192839634238902332182286561531662197194",
                "253803036842026095501384463490416049730",
                "265729264152771178974356876547635159879",
                "225312969560913132350157655513471375124",
                "325875087968488062302278732235656382828",
                "183582510547442134481938977819219539318",
                "311649045907350042241078015558668630370",
                "289601007116746533792038521655408641138"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-211389a3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/anyref.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "97749667397886942190810761839215853557",
            "length": 1971
        },
        "id": "CVE-2025-61670-312e6276",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/linking.c",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "287065451800367318930751320798871806799",
            "length": 209
        },
        "id": "CVE-2025-61670-32ba296e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/include/wasmtime/func.hh",
            "function": "store"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "77766655332018131655520996335915930130",
                "9357118980929513202397500719899514158",
                "156639384664556887526941084303078631296",
                "228993093352600687512056374232140550449"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-347dae0c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/tests/wasip2.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "72594247815070258707741804395519645848",
            "length": 4133
        },
        "id": "CVE-2025-61670-34f160fe",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/tests/func.cc",
            "function": "TEST"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "279126106388697285181870826955548015344",
            "length": 3515
        },
        "id": "CVE-2025-61670-367345ce",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/externref.c",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "327833103535599018587100778939797918775",
                "283366378722565153886485441532750171848",
                "33585783551247361001061056133210512147",
                "244097306390175757044630189762048500535",
                "68846363239376570894735820982922415291",
                "277815760493109594890836158135687507702",
                "187156497876686230317163643180091518390",
                "159717292452880939312448430221668065146"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-37622ac7",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/hello.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "138798311914969214564375182116661752153",
                "146608347529087581120682969483395862879",
                "24014619031820812355558864524067332263",
                "257705988896628119222448346367973554630",
                "77766655332018131655520996335915930130",
                "9357118980929513202397500719899514158",
                "156639384664556887526941084303078631296",
                "228993093352600687512056374232140550449"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-3aacb893",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/tests/component/define_module.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "327833103535599018587100778939797918775",
                "283366378722565153886485441532750171848",
                "33585783551247361001061056133210512147",
                "244097306390175757044630189762048500535",
                "68846363239376570894735820982922415291",
                "277815760493109594890836158135687507702",
                "187156497876686230317163643180091518390",
                "159717292452880939312448430221668065146"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-3bff1773",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/serialize.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "130172377908366107833124579878745766553",
            "length": 210
        },
        "id": "CVE-2025-61670-3efba06c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/serialize.c",
            "function": "hello_callback"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "203184405781699784215635001682468757128",
                "177377563439105819574903396931967270413",
                "97551931936973954330975771885080937590",
                "267899763732771338040844618139965668376",
                "103602472259155667999131327923701941",
                "155696221914348648478513230269743254320",
                "15812577225273489263869762066235728623"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-40389f48",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/tests/func.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "180583778601970458510234087183019259811",
                "288435081160744588087772658287310043221",
                "25888796511390980101087550159796351339",
                "260094651728753213574853883459875760758"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-43f0d4cd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/fib-debug/main.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "311791095344432233896929177857448030535",
                "151360866558810429166894415915509884939",
                "246984357734258602194926730585980722277",
                "103499532884620619702414752887967585161",
                "216265213713227423504792069430925576210",
                "191561323713360916586542108548857924364",
                "215082816980025098037411290339807498207",
                "200140265575093769053044997017236586467",
                "158770433927401890482139169340993201150",
                "265436580850444874691765338222457602555",
                "207006353683284052455433759760628288787",
                "92497323470318700288325401915024645266",
                "160051913977858569861358276066219580760"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-49670135",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/anyref.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "224898079757763304564177008264326986020",
                "168254136822790001041879452232769057600",
                "156536689535008541136702246714871203134",
                "288515495947418872438986995344836497093"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-4ce7f893",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/include/wasmtime/store.hh"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "256470808725184742693791582430940839411",
            "length": 1570
        },
        "id": "CVE-2025-61670-51157091",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/externref.cc",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "241469295356491930855411478137126939313",
            "length": 298
        },
        "id": "CVE-2025-61670-523a44da",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/tests/simple.cc",
            "function": "TEST"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "235886311106327037321880099265340433360",
                "265606457956788435352008785403599868864",
                "76079536550098549391394225619859052737",
                "114104416927874574798023564688814095645",
                "191880617509049790508269194760411118390",
                "145445935307544987024330387339762111567",
                "254218545959826101463814404445063907535",
                "128262829326089299509415778687800798272"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-5c445b93",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/threads.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "186315563336212835568250346235407421690",
            "length": 340
        },
        "id": "CVE-2025-61670-5effb468",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/multi.c",
            "function": "callback"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "19264699883013785367064049247951148379",
            "length": 2467
        },
        "id": "CVE-2025-61670-5fdf5592",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/multi.c",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "271309926711863051943075270055434153494",
            "length": 1325
        },
        "id": "CVE-2025-61670-641d362d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/tests/component/lookup_func.cc",
            "function": "TEST"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "131416095267361906370891594560481311594",
            "length": 2302
        },
        "id": "CVE-2025-61670-66bddeab",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/fuel.c",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "109646761112963135440039868149723910642",
                "277673079691899924276725036014953586937",
                "48968276650467836560216647520782732632",
                "228993093352600687512056374232140550449"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-67c5279c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/tests/component/call_func.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "161922376177555521209378958695445234228",
                "20755879162250323689848541838578054544",
                "129485960807809268010850816529613379315",
                "187250478735286047208103379690090606948",
                "274437742227702155972654970344765638676",
                "16791665294981254976639848724327079663",
                "45396831518796970290258071417765494032",
                "229289187351512377817967472332824026799",
                "168548327183583255085405179863377093133",
                "66683602636950528637709141103372684076",
                "249289771791047943496354595860298115662",
                "163952452176921603347308337827883232161"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-680bc2f9",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/multi.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "156612903066509447911483115207954099671",
                "270792311464176667848847388108118811222",
                "48968276650467836560216647520782732632",
                "228993093352600687512056374232140550449"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-686dac79",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/tests/component/lookup_func.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "334796554231022768052459003790237120130",
            "length": 2405
        },
        "id": "CVE-2025-61670-6f931213",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/anyref.cc",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "66458168728415241524821076957892428517",
            "length": 1696
        },
        "id": "CVE-2025-61670-72790f12",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/wasip1/main.c",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "77566750368483985976795887680601725768",
                "329136920325381753252960003384512656676",
                "70108304270269964620407107656515391035",
                "315611087137574356861024801278673184275",
                "154204285860676903507569248533184615932",
                "331790829797402943882340850795900725251",
                "207550839419374979678814837075753941724",
                "136513091277801952702248408735052157797",
                "158141313505179103204984770789744320153",
                "337393460470967309346362426032361849314",
                "262798952250109939170877653187179891171",
                "61057397274042202735404666881228604401",
                "301073042999582812250314154763460925532",
                "59558759863939478840152232550119987480"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-7284fd99",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/externref.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "191841505628206816341079954460350653126",
            "length": 1611
        },
        "id": "CVE-2025-61670-78cb2143",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/interrupt.c",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "114840428163196700945646720018216867821",
                "233460180292402181037151399258686461190",
                "31674951613549443352876659830307505753",
                "70564616964847033930241967320010631503",
                "121624554233926054235425847746188873131",
                "103133931766694967725977521872726464748",
                "104157151181730359322996130369800275557",
                "297252937990131845517552614283528707197",
                "177849942578825139274353397589225563645",
                "215184076918890812037686769111978777052",
                "193213285210548510020678557439295630790",
                "191454038240556243926867136034745114846",
                "40019116671850068089146883719566678008",
                "161348281757705724995660566446635924063",
                "215879430837435920727415759810551725473",
                "195905397742529488796530006042959621757",
                "20301727398942959668614714512485003153",
                "216015329531504607939195653514812671074",
                "292460814415326607003289557092820711867",
                "74408137119890479624896909000540451940",
                "266907187336241060707236931656377787846",
                "138045932249551830122998867504773762422",
                "240517502983004434107129874639294182764"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-798c18ae",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/include/wasmtime/val.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "310592803155591736493956482831564618935",
            "length": 775
        },
        "id": "CVE-2025-61670-7d56ef8f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/tests/component/instantiate.cc",
            "function": "TEST"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "111865219520797838742041944755378232464",
            "length": 2173
        },
        "id": "CVE-2025-61670-872a0cc2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/fib-debug/main.c",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "279930480565143217902102054163008066903",
            "length": 1421
        },
        "id": "CVE-2025-61670-8e1393cf",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/threads.c",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "290630008375835217478623462414587769891",
                "57637742170203601018926416411439045982",
                "66338951341665873305407264727427793536",
                "141289690566646623527892847482391044632",
                "235485205121596475199564590701037764294"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-915721bd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/fuel.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "91000604233444738355696633859792469397",
            "length": 2302
        },
        "id": "CVE-2025-61670-933a5f2b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/tests/val.cc",
            "function": "TEST"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "195400099034154476133480365874375549069",
                "240750240563837692319908360549103097277",
                "335240993552294711666990225916353338951",
                "7218740632512893057504349179363417206",
                "261218482663245237780612615473197856501",
                "21063579403537326417566571916901673259",
                "239741828280080250612742787242978522265",
                "50414265203910099869574888442125804928",
                "310083116992658765654132527256247387730",
                "30509746464990316643431853401697248863",
                "331318874541863831857081291153836636804",
                "166793712896820615271536644967157150222",
                "184302772951246810638129334464477015478",
                "130246021487282655048962645179199106987",
                "66045663825187151956325075792822440378",
                "211304801468185716670921720993189482226",
                "6305319697366725372476498169233607195",
                "72681213663818739828800791987643961142",
                "260284760955877116731215954957498199617",
                "57425005992871491024753326095430934838"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-a06ee313",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/include/wasmtime/func.hh"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "297466132329909563085956763350899476170",
                "110834722722270291672905165132932162599",
                "94597242398268288400074356479693908916",
                "70439728160943585611541219348243324361",
                "3165870098935666870783044537898357775",
                "237740150181855399247098382916605954225",
                "84869650236102558176526008173632211068",
                "119296684058085238336235726941696458949",
                "166114888177654484026170144136305415085",
                "269309562499494592692238296921025510550",
                "158438673656734168078070029158908298858",
                "55992249969090541203872367244700850062",
                "260284633411987745508417961878061026555",
                "153208273439918791518368531607240351047",
                "287300967335607216799652173481708219177",
                "266773622020625550294274964237300503184",
                "137679006804210181895073327396629289420",
                "92644920078478417453575952142532701601",
                "181267662717590856478373623125004152695",
                "135751964205585184404307497829234020027",
                "189429866090299371808652361313779162116",
                "33129901361646549559354094343193236456"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-a32bf916",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/tests/val.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "155740160241245062684289129554899217163",
                "274807709480807300621892652921995531190",
                "235936488269419013362301296321671775385",
                "102297373283049316013052941462098509473"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-a7b3699f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/tests/simple.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "128289557685912890674923718481782659328",
            "length": 3844
        },
        "id": "CVE-2025-61670-aa5e2313",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/memory.c",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "4080467440490755817595560994959619751",
                "201471988775449496666419609329109334482",
                "249289771791047943496354595860298115662",
                "163952452176921603347308337827883232161"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-add2d479",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/memory.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "254543982338825933390882011430886147853",
                "187255372633711252624763062546659546483",
                "331405379961275344219621132793265762866",
                "126993152517407769790208073439696784242",
                "58329760137976800584683905807908963914",
                "192626668190020590808254970780102604768",
                "80178027127666578463616190237800337962",
                "266600364127563446309850209869628280237",
                "307251874823067339971003353749490088839",
                "313848699820048751069326345786958119060",
                "94020730231012292190635132280381857651",
                "256634557156306598151067577642211399326",
                "183131535472026867148228766379845586142",
                "238785262346813878585746344318374408880",
                "213641728818270061891559956122147200724",
                "143750048590047023378973631592108801145"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-c0c107aa",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/externref.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "29726346071899979322721609055102597888",
            "length": 858
        },
        "id": "CVE-2025-61670-c74ac33b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/tests/wasip2.cc",
            "function": "TEST"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "103247954601109459827439298361169189959",
                "88193762936416258935262211887220828654",
                "335699330162213532100071882971380642038"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-cdd49cee",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/include/wasmtime/error.hh"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "291237301097159691107361908635891887932",
            "length": 1348
        },
        "id": "CVE-2025-61670-cff0840a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/serialize.c",
            "function": "deserialize"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "33325619724730017958982306035875432806",
            "length": 318
        },
        "id": "CVE-2025-61670-d8602854",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/multi.c",
            "function": "closure_callback"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "141132880786133170773034471131430431899",
                "34377469649759624311174259355948408005",
                "60031994141765551974376829056574902254"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-d9af5556",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/wasip1/main.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "338014730825625017262198933162327071535",
                "4298359228070217431441650640082847492",
                "174026454356923402620126573971491484669",
                "228993093352600687512056374232140550449"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-ddddd70e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/tests/component/instantiate.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "283448127530105019765430929819565867416",
                "62435082242828069672051252137148107799",
                "227643792110934379502678983351957407547",
                "235198368444162444072480328756825152531",
                "135082574868719374485572020762533078008",
                "84577054864608704945401046803675193255",
                "280571048211362552669037300559110214414",
                "107214548317158337090368915174406099047",
                "324012361487711828901301526297578632840",
                "234172514480381095946574097466172831847",
                "333869398692891498171025847637069051742",
                "169028161277299052905043211518724409101",
                "247820777145861814787789751594211745611",
                "206656002848403896548431878540182458881",
                "196253629316873493187065598066836360528"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-e102cb3b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/linking.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "100649482660398747285071169360457804122",
            "length": 139
        },
        "id": "CVE-2025-61670-e2459473",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/threads.c",
            "function": "callback"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "130172377908366107833124579878745766553",
            "length": 210
        },
        "id": "CVE-2025-61670-ec586692",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/hello.c",
            "function": "hello_callback"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "76820343168440923426926637402103799127",
            "length": 1906
        },
        "id": "CVE-2025-61670-f1d3c0c1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/hello.c",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "202662241157244468080704785493091146067",
                "92485375978599869562638779582459551655",
                "328686204915383677653849487743462593552",
                "155797797926227884217376768838044204129"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-61670-fa6e0ad6",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/interrupt.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "47109813528394916185042643057489944429",
            "length": 1546
        },
        "id": "CVE-2025-61670-feb7fdb7",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "crates/c-api/tests/component/define_module.cc",
            "function": "TEST"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "30807512783820893787951119236684096393",
            "length": 3990
        },
        "id": "CVE-2025-61670-ff97d429",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3",
        "target": {
            "file": "examples/anyref.c",
            "function": "main"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:00:14Z"