GHSA-g4v2-cjqp-rfmq
High · 8.4CVSS
8.4
EPSS
—
Published
Dec 8, 2025
CISA due date
—
The record
Critical Use-After-Free in Wasmi's Linear Memory
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | wasmi | 0.41.0 | 0.41.2 |
| crates.io | wasmi | 0.42.0 | 0.47.1 |
| crates.io | wasmi | 0.50.0 | 0.51.3 |
| crates.io | wasmi | 1.0.0 | 1.0.1 |
| Chainguard | typst | 0 | 0.14.2-r0 |
| cargo | wasmi | 0.41.0 | 0.41.2 |
| cargo | wasmi | 0.42.0 | 0.47.1 |
| cargo | wasmi | 0.50.0 | 0.51.3 |
| cargo | wasmi | 1.0.0 | 1.0.1 |
Related vulnerabilities
- CVE-2025-66627 Wasmi's Linear Memory has a Critical Use After Free Vulnerability Same vulnerability
- CVE-2026-33056 tar-rs is a tar archive reading/writing library for Rust. Also affects typst
- CVE-2026-33055 tar-rs is a tar archive reading/writing library for Rust. Also affects typst
- CVE-2026-25727 time provides date and time handling in Rust. Also affects typst
- CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-416
- CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-416
- CVE-2026-112402 Pillow is a Python imaging library. CWE-416
- CVE-2026-112396 Pillow is a Python imaging library. CWE-416