CVE-2025-62711CWE-755

CVE-2025-62711

Low · published October 25, 2025

CVSS v3.1
3.1
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched to fix this issue. There are no workarounds.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00428 · 36.0th percentile
Weakness
CWE-755 · Improper Handling of Exceptional Conditions
Published
2025-10-25T02:15Z
Affected products (1)
ProductVersionsFixed in
bytecodealliance/wasmtime≥ 38.0.0, < 38.0.338.0.3
References (3)
https://github.com/bytecodealliance/wasmtime/commit/192f2fcdadfec9d0cf6b58548a85a7307450cbf5 · [email protected]https://github.com/bytecodealliance/wasmtime/pull/11592 · [email protected]https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4h67-722j-5pmc · [email protected]
EPSS history
Timeline
  • 24 OCT 21:54Z
    Wasmtime vulnerable to segfault when using component resources
    cvelistv5