CVE-2025-66627: Critical Use-After-Free in Wasmi's Linear Memory

December 8, 2025 (updated December 9, 2025)

A use-after-free vulnerability has been discovered in the linear memory implementation of Wasmi. This issue can be triggered by a WebAssembly module under certain memory growth conditions, potentially leading to memory corruption, information disclosure, or code execution.

References

github.com/advisories/GHSA-g4v2-cjqp-rfmq
github.com/wasmi-labs/wasmi
github.com/wasmi-labs/wasmi/commit/0e6f0d2a8325602c58d6a53ce1c0e6045eb6a490
github.com/wasmi-labs/wasmi/security/advisories/GHSA-g4v2-cjqp-rfmq
nvd.nist.gov/vuln/detail/CVE-2025-66627

Code Behaviors & Features

Detect and mitigate CVE-2025-66627 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →