Vulnerability-Lookup

CVE-2025-64345 (GCVE-0-2025-64345)

Vulnerability from cvelistv5 – Published: 2025-11-12 21:25 – Updated: 2025-11-12 21:40

Title

Wasmtime provides unsound API access to a WebAssembly shared linear memory

Summary

Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host. Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via `Memory::new` and shared memories are now excluded from core dumps. As a workaround, eembeddings affected by this issue should use `SharedMemory::new` instead of `Memory::new` to create shared memories. Affected embeddings should also disable core dumps if they are unable to upgrade. Note that core dumps are disabled by default but the wasm threads proposal (and shared memory) is enabled by default.

Severity

1.8 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-11-12 21:40 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7734 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/bytecodealliance/wasmtime/secu…	x_refsource_CONFIRM
https://github.com/bytecodealliance/wasmtime/comm…	x_refsource_MISC
https://docs.rs/wasmtime/latest/wasmtime/struct.M…	x_refsource_MISC
https://docs.rs/wasmtime/latest/wasmtime/struct.S…	x_refsource_MISC
https://docs.wasmtime.dev/stability-release.html	x_refsource_MISC
https://github.com/bytecodealliance/wasmtime/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
bytecodealliance	wasmtime	Affected: >= 38.0.1, < 38.0.4 Affected: >= 37.0.0, < 37.0.3 Affected: >= 26.0.0, < 36.0.3 Affected: < 24.0.5	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-64345",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-12T21:40:25.293462Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-12T21:40:37.909Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wasmtime",
          "vendor": "bytecodealliance",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 38.0.1, \u003c 38.0.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 37.0.0, \u003c 37.0.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 26.0.0, \u003c 36.0.3"
            },
            {
              "status": "affected",
              "version": "\u003c 24.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime\u0027s Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host. Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via `Memory::new` and shared memories are now excluded from core dumps. As a workaround, eembeddings affected by this issue should use `SharedMemory::new` instead of `Memory::new` to create shared memories. Affected embeddings should also disable core dumps if they are unable to upgrade. Note that core dumps are disabled by default but the wasm threads proposal (and shared memory) is enabled by default."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 1.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-12T21:25:50.832Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q"
        },
        {
          "name": "https://github.com/bytecodealliance/wasmtime/commit/9ebb6934f00d58b92fb68ed0e0b16c0ae828ca10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/commit/9ebb6934f00d58b92fb68ed0e0b16c0ae828ca10"
        },
        {
          "name": "https://docs.rs/wasmtime/latest/wasmtime/struct.Memory.html#method.new",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.rs/wasmtime/latest/wasmtime/struct.Memory.html#method.new"
        },
        {
          "name": "https://docs.rs/wasmtime/latest/wasmtime/struct.SharedMemory.html#method.new",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.rs/wasmtime/latest/wasmtime/struct.SharedMemory.html#method.new"
        },
        {
          "name": "https://docs.wasmtime.dev/stability-release.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.wasmtime.dev/stability-release.html"
        },
        {
          "name": "https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.4"
        }
      ],
      "source": {
        "advisory": "GHSA-hc7m-r6v8-hg9q",
        "discovery": "UNKNOWN"
      },
      "title": "Wasmtime provides unsound API access to a WebAssembly shared linear memory"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-64345",
    "datePublished": "2025-11-12T21:25:50.832Z",
    "dateReserved": "2025-10-30T17:40:52.031Z",
    "dateUpdated": "2025-11-12T21:40:37.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-64345",
      "date": "2026-10-23",
      "epss": "0.00116",
      "percentile": "0.01543"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "wasmtime",
                "vendor": "bytecodealliance",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 38.0.1, \u003c 38.0.4"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 37.0.0, \u003c 37.0.3"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 26.0.0, \u003c 36.0.3"
                  },
                  {
                    "status": "affected",
                    "version": "\u003c 24.0.5"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime\u0027s Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host. Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via `Memory::new` and shared memories are now excluded from core dumps. As a workaround, eembeddings affected by this issue should use `SharedMemory::new` instead of `Memory::new` to create shared memories. Affected embeddings should also disable core dumps if they are unable to upgrade. Note that core dumps are disabled by default but the wasm threads proposal (and shared memory) is enabled by default."
          },
          {
            "lang": "es",
            "value": "Wasmtime es un entorno de ejecuci\u00f3n para WebAssembly. Versiones anteriores a la 38.0.4, 37.0.3, 36.0.3 y 24.0.5, la API del incrustador Rust de Wasmtime contiene una interacci\u00f3n insegura donde una memoria lineal compartida de WebAssembly podr\u00eda ser vista como un tipo que proporciona acceso seguro al host (Rust) a los contenidos de la memoria lineal. Esto no es seguro para memorias lineales compartidas, las cuales podr\u00edan ser modificadas en paralelo, y esto podr\u00eda llevar a una condici\u00f3n de carrera de datos en el host. Se han emitido lanzamientos de parches para todas las versiones compatibles de Wasmtime, en particular: 24.0.5, 36.0.3, 37.0.3 y 38.0.4. Estas versiones rechazan la creaci\u00f3n de memorias compartidas a trav\u00e9s de \u0027Memory::new\u0027 y las memorias compartidas ahora est\u00e1n excluidas de los volcados de memoria. Como soluci\u00f3n alternativa, las incrustaciones afectadas por este problema deber\u00edan usar \u0027SharedMemory::new\u0027 en lugar de \u0027Memory::new\u0027 para crear memorias compartidas. Las incrustaciones afectadas tambi\u00e9n deber\u00edan deshabilitar los volcados de memoria si no pueden actualizar. Tenga en cuenta que los volcados de memoria est\u00e1n deshabilitados por defecto, pero la propuesta de hilos wasm (y la memoria compartida) est\u00e1 habilitada por defecto."
          }
        ],
        "id": "CVE-2025-64345",
        "lastModified": "2026-10-18T20:10:00.110",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 1.8,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 0.3,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-64345",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-12T21:40:25.293462Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-11-12T22:15:49.623",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://docs.rs/wasmtime/latest/wasmtime/struct.Memory.html#method.new"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://docs.rs/wasmtime/latest/wasmtime/struct.SharedMemory.html#method.new"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://docs.wasmtime.dev/stability-release.html"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/bytecodealliance/wasmtime/commit/9ebb6934f00d58b92fb68ed0e0b16c0ae828ca10"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-23T04:22:19+00:00",
      "cve": "CVE-2025-64345",
      "id": "CVE-2025-64345",
      "initial_release_date": "2025-11-12T21:25:50.832000+00:00",
      "product_status:known_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "wasmtime: Wasmtime unsound API access to shared linear memory",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-64345.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-64345",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-11-12T21:40:25.293462Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-11-12T21:40:34.331Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "wasmtime",
              "vendor": "bytecodealliance",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 38.0.1, \u003c 38.0.4"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 37.0.0, \u003c 37.0.3"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 26.0.0, \u003c 36.0.3"
                },
                {
                  "status": "affected",
                  "version": "\u003c 24.0.5"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime\u0027s Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host. Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via `Memory::new` and shared memories are now excluded from core dumps. As a workaround, eembeddings affected by this issue should use `SharedMemory::new` instead of `Memory::new` to create shared memories. Affected embeddings should also disable core dumps if they are unable to upgrade. Note that core dumps are disabled by default but the wasm threads proposal (and shared memory) is enabled by default."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 1.8,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-362",
                  "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-11-12T21:25:50.832Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q"
            },
            {
              "name": "https://github.com/bytecodealliance/wasmtime/commit/9ebb6934f00d58b92fb68ed0e0b16c0ae828ca10",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/bytecodealliance/wasmtime/commit/9ebb6934f00d58b92fb68ed0e0b16c0ae828ca10"
            },
            {
              "name": "https://docs.rs/wasmtime/latest/wasmtime/struct.Memory.html#method.new",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://docs.rs/wasmtime/latest/wasmtime/struct.Memory.html#method.new"
            },
            {
              "name": "https://docs.rs/wasmtime/latest/wasmtime/struct.SharedMemory.html#method.new",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://docs.rs/wasmtime/latest/wasmtime/struct.SharedMemory.html#method.new"
            },
            {
              "name": "https://docs.wasmtime.dev/stability-release.html",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://docs.wasmtime.dev/stability-release.html"
            },
            {
              "name": "https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.4"
            }
          ],
          "source": {
            "advisory": "GHSA-hc7m-r6v8-hg9q",
            "discovery": "UNKNOWN"
          },
          "title": "Wasmtime provides unsound API access to a WebAssembly shared linear memory"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-64345",
        "datePublished": "2025-11-12T21:25:50.832Z",
        "dateReserved": "2025-10-30T17:40:52.031Z",
        "dateUpdated": "2025-11-12T21:40:37.909Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-64345

Vulnerability from fkie_nvd - Published: 2025-11-12 22:15 - Updated: 2026-10-18 20:10

Severity

1.8 (Low) - CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://docs.rs/wasmtime/latest/wasmtime/struct.Memory.html#method.new
	security-advisories@github.com	https://docs.rs/wasmtime/latest/wasmtime/struct.SharedMemory.html#method.new
	security-advisories@github.com	https://docs.wasmtime.dev/stability-release.html
	security-advisories@github.com	https://github.com/bytecodealliance/wasmtime/commit/9ebb6934f00d58b92fb68ed0e0b16c0ae828ca10
	security-advisories@github.com	https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.4
	security-advisories@github.com	https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "wasmtime",
          "vendor": "bytecodealliance",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 38.0.1, \u003c 38.0.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 37.0.0, \u003c 37.0.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 26.0.0, \u003c 36.0.3"
            },
            {
              "status": "affected",
              "version": "\u003c 24.0.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime\u0027s Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host. Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via `Memory::new` and shared memories are now excluded from core dumps. As a workaround, eembeddings affected by this issue should use `SharedMemory::new` instead of `Memory::new` to create shared memories. Affected embeddings should also disable core dumps if they are unable to upgrade. Note that core dumps are disabled by default but the wasm threads proposal (and shared memory) is enabled by default."
    },
    {
      "lang": "es",
      "value": "Wasmtime es un entorno de ejecuci\u00f3n para WebAssembly. Versiones anteriores a la 38.0.4, 37.0.3, 36.0.3 y 24.0.5, la API del incrustador Rust de Wasmtime contiene una interacci\u00f3n insegura donde una memoria lineal compartida de WebAssembly podr\u00eda ser vista como un tipo que proporciona acceso seguro al host (Rust) a los contenidos de la memoria lineal. Esto no es seguro para memorias lineales compartidas, las cuales podr\u00edan ser modificadas en paralelo, y esto podr\u00eda llevar a una condici\u00f3n de carrera de datos en el host. Se han emitido lanzamientos de parches para todas las versiones compatibles de Wasmtime, en particular: 24.0.5, 36.0.3, 37.0.3 y 38.0.4. Estas versiones rechazan la creaci\u00f3n de memorias compartidas a trav\u00e9s de \u0027Memory::new\u0027 y las memorias compartidas ahora est\u00e1n excluidas de los volcados de memoria. Como soluci\u00f3n alternativa, las incrustaciones afectadas por este problema deber\u00edan usar \u0027SharedMemory::new\u0027 en lugar de \u0027Memory::new\u0027 para crear memorias compartidas. Las incrustaciones afectadas tambi\u00e9n deber\u00edan deshabilitar los volcados de memoria si no pueden actualizar. Tenga en cuenta que los volcados de memoria est\u00e1n deshabilitados por defecto, pero la propuesta de hilos wasm (y la memoria compartida) est\u00e1 habilitada por defecto."
    }
  ],
  "id": "CVE-2025-64345",
  "lastModified": "2026-10-18T20:10:00.110",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 1.8,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 0.3,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-64345",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-11-12T21:40:25.293462Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-11-12T22:15:49.623",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://docs.rs/wasmtime/latest/wasmtime/struct.Memory.html#method.new"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://docs.rs/wasmtime/latest/wasmtime/struct.SharedMemory.html#method.new"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://docs.wasmtime.dev/stability-release.html"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/9ebb6934f00d58b92fb68ed0e0b16c0ae828ca10"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-HC7M-R6V8-HG9Q

Vulnerability from github – Published: 2025-11-12 21:36 – Updated: 2025-11-13 22:02

Summary

Wasmtime provides unsound API access to a WebAssembly shared linear memory

Details

Impact

Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host.

Wasmtime has a wasmtime::Memory type which represents linear memories in a WebAssembly module. Wasmtime also has wasmtime::SharedMemory, however, which represents shared linear memories introduced in the WebAssembly threads proposal. The API of SharedMemory does not provide accessors which return &[u8] in Rust, for example, as that's not a sound type signature when other threads could be modifying memory. The wasmtime::Memory type, however, does provide this API as it's intended to be used with non-shared memories where static knowledge is available that no concurrent or parallel reads or writes are happening. This means that it's not sound to represent a shared linear memory with wasmtime::Memory and it must instead be represented with wasmtime::SharedMemory.

There were two different, erroneous, methods of creating a wasmtime::Memory which represents a shared memory however:

The wasmtime::Memory::new constructor takes a MemoryType which could be shared. This function did not properly reject shared memory types and require usage of SharedMemory::new instead.
Capturing a core dump with WebAssembly would expose all linear memories a wasmtime::Memory. This means that a core dump would perform an unsynchronized read of shared linear memory, possibly leading to data races.

This is a bug in Wasmtime's safe Rust API. It should not be possible to cause unsoundness with Wasmtime's embedding API if unsafe is not used. Embeddings which do not use the wasm threads proposal nor created shared memories nor actually share shared memories across threads are unaffected. Only if shared memories are created across threads might an embedding be affected.

Patches

Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via Memory::new and shared memories are now excluded from core dumps.

Workarounds

Embeddings affected by this issue should use SharedMemory::new instead of Memory::new to create shared memories. Affected embeddings should also disable core dumps if they are unable to upgrade. Note that core dumps are disabled by default but the wasm threads proposal (and shared memory) is enabled by default. It's recommended to upgrade to a patched version of Wasmtime, however.

Severity

1.8 (Low)


                  
                    CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "wasmtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "38.0.0"
            },
            {
              "fixed": "38.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "wasmtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "37.0.0"
            },
            {
              "fixed": "37.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "wasmtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "26.0.0"
            },
            {
              "fixed": "36.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "wasmtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "24.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-64345"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-12T21:36:29Z",
    "nvd_published_at": "2025-11-12T22:15:49Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nWasmtime\u0027s Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host.\n\nWasmtime has a `wasmtime::Memory` type which represents linear memories in a WebAssembly module. Wasmtime also has `wasmtime::SharedMemory`, however, which represents shared linear memories introduced in the WebAssembly `threads` proposal. The API of `SharedMemory` does not provide accessors which return `\u0026[u8]` in Rust, for example, as that\u0027s not a sound type signature when other threads could be modifying memory. The `wasmtime::Memory` type, however, does provide this API as it\u0027s intended to be used with non-shared memories where static knowledge is available that no concurrent or parallel reads or writes are happening. This means that it\u0027s not sound to represent a shared linear memory with `wasmtime::Memory` and it must instead be represented with `wasmtime::SharedMemory`.\n\nThere were two different, erroneous, methods of creating a `wasmtime::Memory` which represents a shared memory however:\n\n1. The [`wasmtime::Memory::new` constructor](https://docs.rs/wasmtime/latest/wasmtime/struct.Memory.html#method.new) takes a `MemoryType` which could be `shared`. This function did not properly reject shared memory types and require usage of [`SharedMemory::new`](https://docs.rs/wasmtime/latest/wasmtime/struct.SharedMemory.html#method.new) instead.\n2. Capturing a core dump with WebAssembly would expose all linear memories a `wasmtime::Memory`. This means that a core dump would perform an unsynchronized read of shared linear memory, possibly leading to data races.\n\nThis is a bug in Wasmtime\u0027s safe Rust API. It should not be possible to cause unsoundness with Wasmtime\u0027s embedding API if `unsafe` is not used. Embeddings which do not use the wasm threads proposal nor created shared memories nor actually share shared memories across threads are unaffected. Only if shared memories are created across threads might an embedding be affected.\n\n### Patches\n\nPatch releases have been issued for [all supported versions of Wasmtime](https://docs.wasmtime.dev/stability-release.html), notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via `Memory::new` and shared memories are now excluded from core dumps. \n\n### Workarounds\n\nEmbeddings affected by this issue should use `SharedMemory::new` instead of `Memory::new` to create shared memories. Affected embeddings should also disable core dumps if they are unable to upgrade. Note that core dumps are disabled by default but the wasm threads proposal (and shared memory) is enabled by default. It\u0027s recommended to upgrade to a patched version of Wasmtime, however.",
  "id": "GHSA-hc7m-r6v8-hg9q",
  "modified": "2025-11-13T22:02:14Z",
  "published": "2025-11-12T21:36:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64345"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/9ebb6934f00d58b92fb68ed0e0b16c0ae828ca10"
    },
    {
      "type": "WEB",
      "url": "https://docs.rs/wasmtime/latest/wasmtime/struct.Memory.html#method.new"
    },
    {
      "type": "WEB",
      "url": "https://docs.rs/wasmtime/latest/wasmtime/struct.SharedMemory.html#method.new"
    },
    {
      "type": "WEB",
      "url": "https://docs.wasmtime.dev/stability-release.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bytecodealliance/wasmtime"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.4"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0118.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Wasmtime provides unsound API access to a WebAssembly shared linear memory"
}

RUSTSEC-2025-0118 (CVE-2025-64345)

Vulnerability from osv_rustsec – Published: 2025-11-11 12:00 – Updated: 2026-10-12 17:47 – Source website

Summary

Unsound API access to a WebAssembly shared linear memory

Details

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q For more information see the GitHub-hosted security advisory.

Severity

1.8 (Low)


                    
                      CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

References

URL

Type

	https://crates.io/crates/wasmtime	PACKAGE
	https://rustsec.org/advisories/RUSTSEC-2025-0118.html	ADVISORY
	https://github.com/bytecodealliance/wasmtime/comm…	WEB

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N",
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "wasmtime",
        "purl": "pkg:cargo/wasmtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "24.0.5"
            },
            {
              "introduced": "25.0.0"
            },
            {
              "fixed": "36.0.3"
            },
            {
              "introduced": "37.0.0"
            },
            {
              "fixed": "37.0.3"
            },
            {
              "introduced": "38.0.0"
            },
            {
              "fixed": "38.0.4"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2025-64345",
    "GHSA-hc7m-r6v8-hg9q"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "This is an entry in the RustSec database for the Wasmtime security advisory\nlocated at\nhttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q\nFor more information see the GitHub-hosted security advisory.",
  "id": "RUSTSEC-2025-0118",
  "modified": "2026-10-12T17:47:59Z",
  "published": "2025-11-11T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/wasmtime"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0118.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/9ebb6934f00d58b92fb68ed0e0b16c0ae828ca10"
    }
  ],
  "related": [],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Unsound API access to a WebAssembly shared linear memory"
}

UBUNTU-CVE-2025-64345 (CVE-2025-64345)

Vulnerability from osv_ubuntu – Published: 2025-11-12 22:15 – Updated: 2026-10-17 09:36 – Source website

Details

Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host. Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via Memory::new and shared memories are now excluded from core dumps. As a workaround, eembeddings affected by this issue should use SharedMemory::new instead of Memory::new to create shared memories. Affected embeddings should also disable core dumps if they are unable to upgrade. Note that core dumps are disabled by default but the wasm threads proposal (and shared memory) is enabled by default.

Severity

1.8 (Low)


                    
                      CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-64345	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-64345	REPORT
	https://docs.rs/wasmtime/latest/wasmtime/struct.M…	REPORT
	https://docs.rs/wasmtime/latest/wasmtime/struct.S…	REPORT
	https://docs.wasmtime.dev/stability-release.html	REPORT
	https://github.com/bytecodealliance/wasmtime/comm…	REPORT
	https://github.com/bytecodealliance/wasmtime/rele…	REPORT
	https://github.com/bytecodealliance/wasmtime/secu…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "librust-cranelift-dev",
            "binary_version": "0.103.0+16.0.0+dfsg-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "rust-wasmtime",
        "purl": "pkg:deb/ubuntu/rust-wasmtime@16.0.0+dfsg-3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.1+dfsg-7",
        "15.0.1+dfsg-4",
        "16.0.0+dfsg-2",
        "16.0.0+dfsg-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "librust-cranelift-dev",
            "binary_version": "0.113.1+26.0.1+dfsg-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "rust-wasmtime",
        "purl": "pkg:deb/ubuntu/rust-wasmtime@26.0.1+dfsg-3?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "26.0.1+dfsg-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "librust-cranelift-dev",
            "binary_version": "0.123.13+36.0.13+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "rust-wasmtime",
        "purl": "pkg:deb/ubuntu/rust-wasmtime@36.0.13+dfsg-1?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "36.0.5+dfsg-1",
        "36.0.13+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "librust-cranelift-dev",
            "binary_version": "0.123.5+36.0.5+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "rust-wasmtime",
        "purl": "pkg:deb/ubuntu/rust-wasmtime@36.0.5+dfsg-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "26.0.1+dfsg-3",
        "26.0.1+dfsg-4",
        "28.0.1+dfsg-3",
        "29.0.1+dfsg-5",
        "36.0.5+dfsg-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime\u0027s Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host. Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via `Memory::new` and shared memories are now excluded from core dumps. As a workaround, eembeddings affected by this issue should use `SharedMemory::new` instead of `Memory::new` to create shared memories. Affected embeddings should also disable core dumps if they are unable to upgrade. Note that core dumps are disabled by default but the wasm threads proposal (and shared memory) is enabled by default.",
  "id": "UBUNTU-CVE-2025-64345",
  "modified": "2026-10-17T09:36:24Z",
  "published": "2025-11-12T22:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-64345"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-64345"
    },
    {
      "type": "REPORT",
      "url": "https://docs.rs/wasmtime/latest/wasmtime/struct.Memory.html#method.new"
    },
    {
      "type": "REPORT",
      "url": "https://docs.rs/wasmtime/latest/wasmtime/struct.SharedMemory.html#method.new"
    },
    {
      "type": "REPORT",
      "url": "https://docs.wasmtime.dev/stability-release.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/9ebb6934f00d58b92fb68ed0e0b16c0ae828ca10"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.4"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-64345"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-64345 (GCVE-0-2025-64345)

FKIE_CVE-2025-64345

GHSA-HC7M-R6V8-HG9Q

Impact

Patches

Workarounds

RUSTSEC-2025-0118 (CVE-2025-64345)

UBUNTU-CVE-2025-64345 (CVE-2025-64345)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour