What’s Vulnerable › Vulnerabilities

CVE-2025-62711: Wasmtime vulnerable to segfault when using component resources

• Severity: low (CVSS 3.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-24 · updated 2026-10-08
• Weakness: CWE-755

Description

Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched to fix this issue. There are no workarounds.

Affected products

• bytecodealliance wasmtime: from 38.0.0 before 38.0.3 — fixed in 38.0.3

How to fix

Upgrade to a fixed version: bytecodealliance wasmtime 38.0.3. Check the vendor advisory for mitigations.

References

• https://github.com/bytecodealliance/wasmtime/commit/192f2fcdadfec9d0cf6b58548a85a7307450cbf5
• https://github.com/bytecodealliance/wasmtime/pull/11592
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4h67-722j-5pmc

Get alerted when CVE-2025-62711 or the next vulnerability affects your stack