CVE-2025-62711 Details
Description
Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched to fix this issue. There are no workarounds.
A vulnerability in Wasmtime's handling of component-model related host-to-Wasm trampolines can lead to a crash of the host application. This issue is present in Wasmtime versions 38.0.0 prior to 38.0.3. The vulnerability arises because the component trampolines were not properly updated during a refactor that removed the use of 'setjmp' and 'longjmp' for stack unwinding. As a result, if an error occurs during the execution of WebAssembly, the missing runtime data can cause the host to segfault or hit an assert failure. Exploiting this vulnerability requires crafting a specific component and using a host embedder that invokes the right type signatures.
Update to Wasmtime version 38.0.3, which has been patched to fix this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 27, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-755 | Improper Handling of Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance wasmtime | >= 38.0.0, < 38.0.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2025 | Initial Analysis | [email protected] |
| Oct 24, 2025 | New CVE Received | [email protected] |