8.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66627

CVE-2025-66627: Critical Use-After-Free in Wasmi's Linear Memory

Summary

A use-after-free vulnerability has been discovered in the linear memory implementation of Wasmi. This issue can be triggered by a WebAssembly module under certain memory growth conditions, potentially leading to memory corruption, information disclosure, or code execution.

Impact

Confidentiality: High – attacker-controlled memory reads possible.
Integrity: High – memory corruption may allow arbitrary writes.
Availability: High – interpreter crashes possible.

Affected Versions

Wasmi v0.41.0 through Wasmi v1.0.0.

Workarounds

Upgrade to the latest patched version of Wasmi.
Consider limiting the maximum linear memory sizes where feasible.

Credits

This vulnerability was discovered by Robert T. Morris (RTM).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66627

CVE-2025-66627:

8.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wasmi	rust	>= 0.41.0, < 0.41.2	0.41.2
wasmi	rust	>= 0.42.0, < 0.47.1	0.47.1
wasmi	rust	>= 0.50.0, < 0.51.3	0.51.3
wasmi	rust	>= 1.0.0, < 1.0.1	1.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security patch (commit 0e6f0d2a8325602c58d6a53ce1c0e6045eb6a490) reveals a classic use-after-free vulnerability in Wasmi's ByteBuffer implementation, which is used for WebAssembly linear memory.

The core of the vulnerability lies in the ByteBuffer::get_vec function. The original implementation reconstructed a Vec<u8> from raw parts (ptr, len, capacity) and returned it to the caller. According to Rust's ownership rules, the caller would then own this Vec. When the Vec went out of scope (for example, at the end of the function that called get_vec, likely the ByteBuffer::grow function mentioned in the commit message), it would be dropped, and its underlying memory buffer would be deallocated.

The problem is that the ByteBuffer instance itself was not consumed or invalidated and still held the now-dangling pointer (self.ptr) to the freed memory. Any subsequent use of this ByteBuffer, such as another memory access or a growth operation, would trigger a use-after-free condition. This could be exploited by a malicious WebAssembly module to corrupt memory, read sensitive data, or achieve code execution.

The patch addresses this by modifying ByteBuffer::get_vec to return a ManuallyDrop<Vec<u8>>. This wrapper type prevents the Vec from being automatically deallocated when it goes out of scope, transferring the responsibility of memory management to the caller. The ByteBuffer::grow_vec function was also updated to accept this ManuallyDrop type, ensuring the memory buffer is handled safely throughout the growth operation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.4

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-66627: Critical Use-After-Free in Wasmi's Linear Memory

Summary

Impact

Affected Versions

Workarounds

Credits

CVE-2025-66627:

8.4

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

8.4

8.4

CVE-2025-66627: Critical Use-After-Free in Wasmi's Linear Memory

Summary

Impact

Affected Versions

Workarounds

Credits

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI