{"id":"CVE-2025-62711","title":"Wasmtime is a runtime for WebAssembly","summary":"Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which…","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-755"],"vendor":"bytecodealliance","product":"wasmtime","affected":["wasmtime >= 38.0.0, < 38.0.3"],"patched":["wasmtime 38.0.3"],"published":"2025-10-24","updated":"2026-10-08","sourceUpdated":"2026-10-08T11:10:00.250","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-62711","references":[{"url":"https://github.com/bytecodealliance/wasmtime/commit/192f2fcdadfec9d0cf6b58548a85a7307450cbf5","label":"security-advisories@github.com"},{"url":"https://github.com/bytecodealliance/wasmtime/pull/11592","label":"security-advisories@github.com"},{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4h67-722j-5pmc","label":"security-advisories@github.com"},{"url":"https://crates.io/crates/wasmtime"},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0112.html"}],"tags":["nvd","osv","rust"],"epss":0.0041,"epssPercentile":0.35067,"ingestedAt":"2026-10-01T18:55:42.300Z","aliases":["RUSTSEC-2025-0112","GHSA-4h67-722j-5pmc"],"ecosystem":"rust","slug":"CVE-2025-62711","body":"## Overview\n\nWasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched to fix this issue. There are no workarounds.\n\n## Affected\n\n- `wasmtime >= 38.0.0, < 38.0.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `wasmtime 38.0.3`\n\n## Package advisory (CVE-2025-62711)\n\nAffected packages:\n\n- `wasmtime >= 38.0.0, < 38.0.3`\n\nPatched in:\n\n- `wasmtime 38.0.3`\n\nSource: https://osv.dev/vulnerability/RUSTSEC-2025-0112","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}