CVE-2025-64345
published 2025-11-12CVE-2025-64345: Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where…
PriorityP48low1.8CVSS 3.1
AVLACHPRHUIRSUCNILAN
EPSS
0.09%
0.8th percentile
Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host. Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via `Memory::new` and shared memories are now excluded from core dumps. As a workaround, eembeddings affected by this issue should use `SharedMemory::new` instead of `Memory::new` to create shared memories. Affected embeddings should also disable core dumps if they are unable to upgrade. Note that core dumps are disabled by default but the wasm threads proposal (and shared memory) is enabled by default.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bytecodealliance | wasmtime | < 24.0.5 | 24.0.5 |
| bytecodealliance | wasmtime | — | — |
| bytecodealliance | wasmtime | — | — |
| bytecodealliance | wasmtime | — | — |
| bytecodealliance | wasmtime | >= 0 < 24.0.5 | 24.0.5 |
| bytecodealliance | wasmtime | >= 0.0.0-0 < 24.0.5 | 24.0.5 |
| bytecodealliance | wasmtime | >= 25.0.0 < 36.0.3 | 36.0.3 |
| bytecodealliance | wasmtime | >= 26.0.0 < 36.0.3 | 36.0.3 |
| bytecodealliance | wasmtime | >= 37.0.0 < 37.0.3 | 37.0.3 |
| bytecodealliance | wasmtime | >= 38.0.0 < 38.0.4 | 38.0.4 |
| debian | rust-wasmtime | < rust-wasmtime 27.0.0+dfsg-2 (forky) | rust-wasmtime 27.0.0+dfsg-2 (forky) |
CVSS provenance
nvdv3.11.8LOWCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
osv1.8LOW
vendor_debian1.8LOW
vendor_redhat1.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Wasmtime provides unsound API access to a WebAssembly shared linear memory
osv·2025-11-12
CVE-2025-64345 [LOW] Wasmtime provides unsound API access to a WebAssembly shared linear memory
Wasmtime provides unsound API access to a WebAssembly shared linear memory
### Impact
Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host.
Wasmtime has a `wasmtime::Memory` type which represents linear memories in a WebAssembly module. Wasmtime also has `wasmtime::SharedMemory`, however, which represents shared linear memories introduced in the WebAssembly `threads` proposal. The API of `SharedMemory` does not provide accessors which return `&[u8]` in Rust, for example, as that's not a sound type signa
GHSA
Wasmtime provides unsound API access to a WebAssembly shared linear memory
ghsa·2025-11-12
CVE-2025-64345 [LOW] CWE-362 Wasmtime provides unsound API access to a WebAssembly shared linear memory
Wasmtime provides unsound API access to a WebAssembly shared linear memory
### Impact
Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host.
Wasmtime has a `wasmtime::Memory` type which represents linear memories in a WebAssembly module. Wasmtime also has `wasmtime::SharedMemory`, however, which represents shared linear memories introduced in the WebAssembly `threads` proposal. The API of `SharedMemory` does not provide accessors which return `&[u8]` in Rust, for example, as that's not a sound type signa
OSV
CVE-2025-64345: Wasmtime is a runtime for WebAssembly
osv·2025-11-12·CVSS 1.8
CVE-2025-64345 [LOW] CVE-2025-64345: Wasmtime is a runtime for WebAssembly
Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host. Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via `Memory::new` and shared memories are now excluded from core dumps. As a workaround, eembeddings affected by this issue should use `SharedMemory::new` instead of `Memory::new` to create shared m
OSV
Unsound API access to a WebAssembly shared linear memory
osv·2025-11-11
CVE-2025-64345 Unsound API access to a WebAssembly shared linear memory
Unsound API access to a WebAssembly shared linear memory
This is an entry in the RustSec database for the Wasmtime security advisory
located at
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q
For more information see the GitHub-hosted security advisory.
Red Hat
wasmtime: Wasmtime unsound API access to shared linear memory
vendor_redhat·2025-11-12·CVSS 1.8
CVE-2025-64345 [LOW] CWE-362 wasmtime: Wasmtime unsound API access to shared linear memory
wasmtime: Wasmtime unsound API access to shared linear memory
Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host. Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via `Memory::new` and shared memories are now excluded from core dumps. As a workaround, eembeddings affected by this issue should use
Debian
CVE-2025-64345: rust-wasmtime - Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, ...
vendor_debian·2025·CVSS 1.8
CVE-2025-64345 [LOW] CVE-2025-64345: rust-wasmtime - Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, ...
Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host. Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via `Memory::new` and shared memories are now excluded from core dumps. As a workaround, eembeddings affected by this issue should use `SharedMemory::new` instead of `Memory::new` to create shared m
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://docs.rs/wasmtime/latest/wasmtime/struct.Memory.html#method.newhttps://docs.rs/wasmtime/latest/wasmtime/struct.SharedMemory.html#method.newhttps://docs.wasmtime.dev/stability-release.htmlhttps://github.com/bytecodealliance/wasmtime/commit/9ebb6934f00d58b92fb68ed0e0b16c0ae828ca10https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.4https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q
2025-11-12
Published