DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2025-61670: CVE-2025-61670: Memory Leak in Wasmtime C/C++ API WebAssembly GC Reference Handling

#security #cve #cybersecurity

CVE-2025-61670: Memory Leak in Wasmtime C/C++ API WebAssembly GC Reference Handling

Vulnerability ID: CVE-2025-61670
CVSS Score: 3.3
Published: 2026-07-14

A technical analysis of CVE-2025-61670, a memory leak vulnerability in Wasmtime's C and C++ API bindings. The issue stems from a refactoring in version 37.0.0 that transitioned garbage-collected reference tracking to host heap-allocated OwnedRooted types without updating FFI ownership semantics.

TL;DR

A memory leak in Wasmtime v37.0.0-37.0.1 C/C++ bindings allows local guest modules to exhaust host memory and cause a denial of service.

Technical Details

  • CWE ID: CWE-772
  • Attack Vector: Local (AV:L)
  • CVSS v3.1: 3.3 (Low)
  • EPSS Score: 0.00178 (0.18% probability)
  • Impact: Availability (Memory Exhaustion / DoS)
  • Exploit Status: No public PoC
  • KEV Status: Not listed

Affected Systems

  • Wasmtime C and C++ API bindings
  • Downstream bindings utilizing C APIs (e.g. wasmtime-py)
  • Wasmtime: >= 37.0.0, <= 37.0.1 (Fixed in: 37.0.2)

Mitigation Strategies

  • Upgrade Wasmtime to version 37.0.2 or higher.
  • Avoid using GC-managed values (anyref, externref) over C/C++ boundaries, substituting primitive index handles instead.

Remediation Steps:

  1. Update build dependencies (e.g., Cargo, CMake) to pull Wasmtime v37.0.2 or later.
  2. Recompile the C/C++ host application using the updated headers to inherit the corrected RAII destructors.
  3. Run runtime tests using AddressSanitizer or Valgrind to verify that GC reference lifecycles are correctly reclaimed upon scope exit.

References

Read the full report for CVE-2025-61670 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)