CVE-2025-62711
Low
Description
Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched to fix this issue. There are no workarounds.
SeverityLow
CVSS3.1
Exploit probability—
ProductBytecodealliance Wasmtime
PublishedOct 24, 2025
First seenOct 24, 2025
Weakness typeCWE-755CWE-755
How to fix
Update
- bytecodealliance wasmtime38.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bytecodealliance wasmtime | 38.0.0 ≤ v < 38.0.3 | 38.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.