RUSTSEC-2025-0118
Low · 1.8CVSS
1.8
EPSS
—
Published
Nov 11, 2025
CISA due date
—
The record
Unsound API access to a WebAssembly shared linear memory
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | wasmtime | 0 | 24.0.5 |
| crates.io | wasmtime | 0.0.0-0 | 24.0.5 |
| crates.io | wasmtime | 26.0.0 | 36.0.3 |
| crates.io | wasmtime | 37.0.0 | 37.0.3 |
| crates.io | wasmtime | 38.0.0 | 38.0.4 |
| cargo | wasmtime | 26.0.0 | 36.0.3 |
| cargo | wasmtime | 37.0.0 | 37.0.3 |
| cargo | wasmtime | 38.0.0 | 38.0.4 |
Related vulnerabilities
- CVE-2025-64345 Wasmtime is a runtime for WebAssembly. Same vulnerability
- CVE-2026-44216 Wasmtime is a runtime for WebAssembly. Also affects wasmtime
- RUSTSEC-2026-0114 Panic when allocating a table exceeding the size of the host's address space Also affects wasmtime
- CVE-2026-34988 Wasmtime is a runtime for WebAssembly. Also affects wasmtime
- CVE-2026-35195 Wasmtime is a runtime for WebAssembly. Also affects wasmtime
- CVE-2026-34987 Wasmtime is a runtime for WebAssembly. Also affects wasmtime
- CVE-2026-35186 Wasmtime is a runtime for WebAssembly. Also affects wasmtime
- CVE-2026-34971 Wasmtime is a runtime for WebAssembly. Also affects wasmtime