Wasmi CVE-2025-66627

Requires a host application that embeds Wasmi (vulnerable ranges: >=0.41.0 <0.41.2, >=0.42.0 <0.47.1, >=0.50.0 <0.51.3, and 1.0.0) AND executes attacker-influenced WebAssembly modules; the flaw is reached only when a guest module drives Wasmi's linear memory through 'certain memory growth conditions' (i.e. exercising memory.grow / linear-memory reallocation paths). Exploitation is LIMITED by the need to supply and run a module (PR:L - not fully anonymous unless the embedding exposes WASM execution to untrusted input) and by deployment: hosts that run only trusted, first-party modules are not practically exposed. The documented workaround - capping maximum linear memory sizes - constrains the growth conditions and reduces exploitability where configurable.

Signals are moderately consistent but point to a conditional, not a mass-exploitation, threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a locally-reachable flaw with low attack complexity and some privilege required, yielding full confidentiality/integrity/availability impact within an unchanged scope - consistent with a use-after-free (CWE-416) in the interpreter's linear memory that an attacker-supplied WebAssembly module triggers. EPSS is very low (0.15%, 3rd percentile), the CVE is NOT on CISA KEV, and no public exploit was provided in the input, so there is no evidence of active or imminent widespread exploitation. The key nuance for interpreting 'AV:L/PR:L': in a Wasmi embedding the real threat surface is any host that executes untrusted/guest WebAssembly, where 'supplying a module' is the intended low-privilege capability - so for sandboxing or plugin/blockchain use cases this is effectively a sandbox-escape primitive and should be prioritized, whereas hosts that only run trusted, first-party modules face little practical risk. Net: a genuinely serious memory-safety bug (GHSA labels it 'Critical') worth prompt patching for anyone running untrusted WASM, but low real-world exploitation pressure today per EPSS/KEV. No conflicting data of note; vector and description align.

An application embeds Wasmi to run untrusted or third-party WebAssembly modules (e.g. a plugin host or on-chain runtime). An attacker submits a crafted module that forces specific linear-memory growth conditions, triggering the use-after-free to read or corrupt host memory and potentially execute code in the host process. No public exploit code was identified at time of analysis, so this reflects the described capability rather than a weaponized PoC.