GHSA-g4v2-cjqp-rfmq

Source

https://github.com/advisories/GHSA-g4v2-cjqp-rfmq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-g4v2-cjqp-rfmq/GHSA-g4v2-cjqp-rfmq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g4v2-cjqp-rfmq

Aliases

CVE-2025-66627

Published

2025-12-08T22:15:49Z

Modified

2025-12-09T19:37:08.784119Z

Severity

8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Critical Use-After-Free in Wasmi's Linear Memory

Details

Summary

A use-after-free vulnerability has been discovered in the linear memory implementation of Wasmi. This issue can be triggered by a WebAssembly module under certain memory growth conditions, potentially leading to memory corruption, information disclosure, or code execution.

Impact

Confidentiality: High – attacker-controlled memory reads possible.
Integrity: High – memory corruption may allow arbitrary writes.
Availability: High – interpreter crashes possible.

Affected Versions

Wasmi v0.41.0 through Wasmi v1.0.0.

Workarounds

Upgrade to the latest patched version of Wasmi.
Consider limiting the maximum linear memory sizes where feasible.

Credits

This vulnerability was discovered by Robert T. Morris (RTM).

Database specific

{
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-416"
    ],
    "github_reviewed_at": "2025-12-08T22:15:49Z",
    "nvd_published_at": "2025-12-09T16:18:21Z",
    "github_reviewed": true
}

References