---
id: CVE-2025-66627
title: Wasmi is a WebAssembly interpreter focused on constrained and embedded systems
summary: >-
  Wasmi is a WebAssembly interpreter focused on constrained and embedded
  systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through
  0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After
  Free vulnerabil…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: wasmi-labs
product: wasmi
affected:
  - 'wasmi >= 0.41.0, < 0.41.2'
  - 'wasmi >= 0.47.0, < 0.47.1'
  - 'wasmi >= 0.51.0, < 0.51.3'
  - wasmi = 1.0.0
patched:
  - wasmi 0.51.3
published: '2025-12-09'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T21:10:00.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66627'
references:
  - url: >-
      https://github.com/wasmi-labs/wasmi/security/advisories/GHSA-g4v2-cjqp-rfmq
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00146
epssPercentile: 0.03434
ingestedAt: '2026-10-14T21:57:04.747Z'
---

## Overview

Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code execution. This issue is fixed in versions 0.41.2, 0.47.1, 0.51.3 and 1.0.1. To workaround this issue, consider limiting the maximum linear memory sizes where feasible.

## Affected

- `wasmi >= 0.41.0, < 0.41.2`
- `wasmi >= 0.47.0, < 0.47.1`
- `wasmi >= 0.51.0, < 0.51.3`
- `wasmi = 1.0.0`

## Remediation

Upgrade past the affected range:

- `wasmi 0.51.3`