CVE-2025-64345
November 12, 2025
Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host. Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via "Memory::new" and shared memories are now excluded from core dumps. As a workaround, eembeddings affected by this issue should use "SharedMemory::new" instead of "Memory::new" to create shared memories. Affected embeddings should also disable core dumps if they are unable to upgrade. Note that core dumps are disabled by default but the wasm threads proposal (and shared memory) is enabled by default.
Affected Packages
https://github.com/bytecodealliance/wasmtime.git (GITHUB):
Affected version(s) >=v0.2.0 <v24.0.5Fix Suggestion:
Update to version v24.0.5https://github.com/bytecodealliance/wasmtime.git (GITHUB):
Affected version(s) >=v38.0.1 <v38.0.4Fix Suggestion:
Update to version v38.0.4https://github.com/bytecodealliance/wasmtime.git (GITHUB):
Affected version(s) >=v26.0.0 <v36.0.3Fix Suggestion:
Update to version v36.0.3https://github.com/bytecodealliance/wasmtime.git (GITHUB):
Affected version(s) >=v37.0.0 <v37.0.3Fix Suggestion:
Update to version v37.0.3wasmtime (RUST):
Affected version(s) >=38.0.0 <38.0.4Fix Suggestion:
Update to version 38.0.4wasmtime (RUST):
Affected version(s) >=37.0.0 <37.0.3Fix Suggestion:
Update to version 37.0.3wasmtime (RUST):
Affected version(s) >=26.0.0 <36.0.3Fix Suggestion:
Update to version 36.0.3wasmtime (RUST):
Affected version(s) >=0.3.0 <24.0.5Fix Suggestion:
Update to version 24.0.5Related ResourcesĀ (10)
Do you need more information?
Contact UsCVSS v4
Base Score:
1
Attack Vector
LOCAL
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
HIGH
User Interaction
PASSIVE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
1.8
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
EPSS
Base Score:
0.01