Vulnerability Description
Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched to fix this issue. There are no workarounds.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bytecodealliance | Wasmtime | >= 38.0.0, < 38.0.3 |
Related Weaknesses (CWE)
References
- https://github.com/bytecodealliance/wasmtime/commit/192f2fcdadfec9d0cf6b58548a85Patch
- https://github.com/bytecodealliance/wasmtime/pull/11592Patch
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4h67-722j-PatchThird Party Advisory
FAQ
What is CVE-2025-62711?
CVE-2025-62711 is a vulnerability with a CVSS score of 3.1 (LOW). Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible ...
How severe is CVE-2025-62711?
CVE-2025-62711 has been rated LOW with a CVSS base score of 3.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-62711?
Check the references section above for vendor advisories and patch information. Affected products include: Bytecodealliance Wasmtime.