{"action":"Upgrade wasmtime to 24.0.5 or later.","affected":[{"fixed":"38.0.4","introduced":"38.0.0"},{"fixed":"37.0.3","introduced":"37.0.0"},{"fixed":"36.0.3","introduced":"26.0.0"},{"fixed":"24.0.5","introduced":"0"}],"component":"wasmtime","cve_ids":["CVE-2025-64345"],"ecosystem":"crates.io","epss":0.00116,"exploited":false,"fixed_versions":["38.0.4","37.0.3","36.0.3","24.0.5"],"ghsa_id":"GHSA-hc7m-r6v8-hg9q","id":"tcs_01M5KF0FEC2WVZQSH9D3ZFGJVX","modified_at":"2026-09-10T03:50:31.065532842Z","published_at":"2025-11-12T21:36:29Z","references":["https://osv.dev/vulnerability/GHSA-hc7m-r6v8-hg9q","https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q","https://nvd.nist.gov/vuln/detail/CVE-2025-64345","https://github.com/bytecodealliance/wasmtime/commit/9ebb6934f00d58b92fb68ed0e0b16c0ae828ca10","https://docs.rs/wasmtime/latest/wasmtime/struct.Memory.html#method.new","https://docs.rs/wasmtime/latest/wasmtime/struct.SharedMemory.html#method.new","https://docs.wasmtime.dev/stability-release.html","https://github.com/bytecodealliance/wasmtime","https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.4","https://rustsec.org/advisories/RUSTSEC-2025-0118.html"],"severity":{"label":"low","score":1.8},"sources":[{"source":"osv","source_id":"GHSA-hc7m-r6v8-hg9q","url":"https://osv.dev/vulnerability/GHSA-hc7m-r6v8-hg9q"}],"summary":"Wasmtime provides unsound API access to a WebAssembly shared linear memory"}