{"action":"Upgrade wasmtime to 24.0.5 or later.","affected":[{"fixed":"24.0.5","introduced":"0.0.0-0"},{"fixed":"36.0.3","introduced":"25.0.0"},{"fixed":"37.0.3","introduced":"37.0.0"},{"fixed":"38.0.4","introduced":"38.0.0"}],"component":"wasmtime","cve_ids":["CVE-2025-64345"],"ecosystem":"crates.io","epss":0.00116,"exploited":false,"fixed_versions":["24.0.5","36.0.3","37.0.3","38.0.4"],"ghsa_id":"GHSA-hc7m-r6v8-hg9q","id":"tcs_01M5KFACG0C4GT39XR6DPWZQYZ","modified_at":"2026-10-12T18:00:07.413203425Z","published_at":"2025-11-11T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2025-0118","https://crates.io/crates/wasmtime","https://rustsec.org/advisories/RUSTSEC-2025-0118.html","https://github.com/bytecodealliance/wasmtime/commit/9ebb6934f00d58b92fb68ed0e0b16c0ae828ca10"],"severity":{"label":"low","score":1.8},"sources":[{"source":"osv","source_id":"RUSTSEC-2025-0118","url":"https://osv.dev/vulnerability/RUSTSEC-2025-0118"}],"summary":"Unsound API access to a WebAssembly shared linear memory"}