CVE-2025-66627
High · 8.4CVSS
8.4
EPSS
0.1%
Published
Dec 9, 2025
CISA due date
—
The record
Wasmi's Linear Memory has a Critical Use After Free Vulnerability
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | wasmi | 0.41.0 | 0.41.2 |
| crates.io | wasmi | 0.42.0 | 0.47.1 |
| crates.io | wasmi | 0.50.0 | 0.51.3 |
| crates.io | wasmi | 1.0.0 | 1.0.1 |
| Chainguard | typst | 0 | 0.14.2-r0 |
| cargo | wasmi | 0.41.0 | 0.41.2 |
| cargo | wasmi | 0.42.0 | 0.47.1 |
| cargo | wasmi | 0.50.0 | 0.51.3 |
| cargo | wasmi | 1.0.0 | 1.0.1 |
Related vulnerabilities
- GHSA-g4v2-cjqp-rfmq Critical Use-After-Free in Wasmi's Linear Memory Same vulnerability
- CVE-2026-33056 tar-rs is a tar archive reading/writing library for Rust. Also affects typst
- CVE-2026-33055 tar-rs is a tar archive reading/writing library for Rust. Also affects typst
- CVE-2026-25727 time provides date and time handling in Rust. Also affects typst
- CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-416
- CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-416
- CVE-2026-112402 Pillow is a Python imaging library. CWE-416
- CVE-2026-112396 Pillow is a Python imaging library. CWE-416