CVE-2025-64345

Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host. Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via `Memory::new` and shared memories are now excluded from core dumps. As a workaround, eembeddings affected by this issue should use `SharedMemory::new` instead of `Memory::new` to create shared memories. Affected embeddings should also disable core dumps if they are unable to upgrade. Note that core dumps are disabled by default but the wasm threads proposal (and shared memory) is enabled by default.

• CWE-362

• https://docs.rs/wasmtime/latest/wasmtime/struct.Memory.html#method.new
• https://docs.rs/wasmtime/latest/wasmtime/struct.SharedMemory.html#method.new
• https://docs.wasmtime.dev/stability-release.html
• https://github.com/bytecodealliance/wasmtime/commit/9ebb6934f00d58b92fb68ed0e0b16c0ae828ca10
• https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.4
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q

Published

Nov 12, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64339ClipBucket v5 is an open source video sharing platform. In v…5.4
• CVE-2025-6434The exception page for the HTTPS-Only feature, displayed whe…4.3
• CVE-2025-64340FastMCP is the standard framework for building MCP applicati…7.8
• CVE-2025-64342ESF-IDF is the Espressif Internet of Things (IOT) Developmen…6.9
• CVE-2025-64343(conda) Constructor is a tool that enables users to create i…7.8
• CVE-2025-64344Suricata is a network IDS, IPS and NSM engine developed by t…7.5
• CVE-2025-64346archives is a Go library for extracting archives (tar, zip, …6
• CVE-2025-64347Apollo Router Core is a configurable Rust graph router writt…7.5
• CVE-2025-64348ELOG allows an authenticated user to modify or overwrite the…7.1
• CVE-2025-64349ELOG allows an authenticated user to modify another user's p…8.8
• CVE-2025-6435If a user saved a response from the Network tab in Devtools …8.1
• CVE-2025-64350Missing Authorization vulnerability in Rank Math SEO Rank Ma…3.8