Listen to this Post
The use-after-free vulnerability in Wasmi’s linear memory implementation occurs due to improper memory management during WebAssembly linear memory growth operations. When a WebAssembly module instructs the runtime to grow its linear memory, Wasmi may reallocate or free the underlying memory buffer. However, internal pointers or references to the old buffer are not consistently updated or invalidated. This leaves dangling pointers that can be accessed after the memory has been freed. An attacker can craft a malicious WebAssembly module that deliberately triggers memory growth under specific conditions, such as by calling the `memory.grow` instruction repeatedly or in sequence with other memory operations. Following the growth, if the module accesses memory through retained references, it reads from or writes to freed memory. This corrupts the heap, as the freed memory may have been reallocated for other purposes. The corruption can lead to sensitive information disclosure if freed memory contains residual data, or to arbitrary code execution if an attacker manipulates control structures. The vulnerability is inherent in the memory handling logic across multiple Wasmi versions, where lifecycle management of linear memory buffers is flawed. The use-after-free provides a primitive for further exploitation, potentially compromising the host process executing the Wasmi interpreter.
Platform: Wasmi
Version: Multiple affected versions
Vulnerability: Use-After-Free
Severity: High
Date: Dec 8, 2025
Prediction: Patched Dec 8
What Undercode Say:
Analytics
cargo tree | grep wasmi cargo update wasmi cargo audit
how Exploit:
Craft malicious WebAssembly module with memory.grow instructions and subsequent memory accesses to trigger use-after-free.
Protection from this CVE
Update to patched versions: 0.41.2, 0.47.1, 0.51.3, or 1.0.1.
Impact:
Memory corruption, information disclosure, remote code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
