What is GHSA-g4v2-cjqp-rfmq?

GHSA-g4v2-cjqp-rfmq is a security advisory published by GitHub Security Advisories with High severity. Critical Use-After-Free in Wasmi's Linear Memory

Which CVE IDs does GHSA-g4v2-cjqp-rfmq cover?

GHSA-g4v2-cjqp-rfmq covers the following CVE IDs: CVE-2025-66627. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g4v2-cjqp-rfmq?

GHSA-g4v2-cjqp-rfmq has a CVSS v3 base score of 8.4, published by GitHub Security Advisories.

Which products are affected by GHSA-g4v2-cjqp-rfmq?

GHSA-g4v2-cjqp-rfmq affects 4 products, including: rust/wasmi:\u003e= 0.41.0, \u003c 0.41.2; rust/wasmi:\u003e= 0.42.0, \u003c 0.47.1; rust/wasmi:\u003e= 0.50.0, \u003c 0.51.3; rust/wasmi:\u003e= 1.0.0, \u003c 1.0.1.

GHSA-g4v2-cjqp-rfmqHighCVSS 8.4

Critical Use-After-Free in Wasmi's Linear Memory

Vendor

GitHub Security Advisories

Published

December 8, 2025

Last Modified

December 9, 2025

🔗 CVE IDs covered (1)

CVE-2025-66627 →

📋 Description

Summary

A use-after-free vulnerability has been discovered in the linear memory implementation of Wasmi. This issue can be triggered by a WebAssembly module under certain memory growth conditions, potentially leading to memory corruption, information disclosure, or code execution.

Impact

Confidentiality: High – attacker-controlled memory reads possible.
Integrity: High – memory corruption may allow arbitrary writes.
Availability: High – interpreter crashes possible.

Affected Versions

Wasmi v0.41.0 through Wasmi v1.0.0.

Workarounds

Upgrade to the latest patched version of Wasmi.
Consider limiting the maximum linear memory sizes where feasible.

Credits

This vulnerability was discovered by Robert T. Morris (RTM).

🎯 Affected products4

rust/wasmi:>= 0.41.0, < 0.41.2
rust/wasmi:>= 0.42.0, < 0.47.1
rust/wasmi:>= 0.50.0, < 0.51.3
rust/wasmi:>= 1.0.0, < 1.0.1