Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-69261: WasmEdge allows out-of-bounds memory access before 0.16.0-alpha.3

CVE-2025-69261 · published 10 months ago

Summary

The WasmEdge WebAssembly runtime (versions before 0.16.0-alpha.3) can mis‑calculate memory size, letting code read or write beyond the allocated area. This can cause the program to crash unexpectedly. Upgrade to version 0.16.0-alpha.3 or later to apply the fix.

What to do

Update debian wasmedge to version 0.16.0+dfsg-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:13	debian	wasmedge	All versions
Debian:14	debian	wasmedge	< 0.16.0+dfsg-1 Fix: upgrade to 0.16.0+dfsg-1
Ubuntu:24.04:LTS	canonical	wasmedge	All versions

Original advisory text

WasmEdge integer wrap in MemoryInstance::getSpan()'s memory size check

WasmEdge is a WebAssembly runtime. Prior to version 0.16.0-alpha.3, a multiplication in `WasmEdge/include/runtime/instance/memory.h` can wrap, causing `checkAccessBound()` to incorrectly allow the access. This leads to a segmentation fault. Version 0.16.0-alpha.3 contains a patch for the issue.

References

https://security-tracker.debian.org/tracker/CVE-2025-69261 Vendor Advisory
https://ubuntu.com/security/CVE-2025-69261 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-69261 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69261... Vendor Advisory
https://github.com/WasmEdge/WasmEdge/security/advisories/GHSA-89fm-8mr7-gg4m Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-69261 Vendor Advisory
https://github.com/WasmEdge/WasmEdge/commit/37cc9fa19bd23edbbdaa9252059b17f191fa... Patch

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-190Integer Overflow

Timeline

Published30 Dec 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-69261 · NVD

DEBIAN-CVE-2025-69261 · OSV

GHSA-89fm-8mr7-gg4m · GHSA

CVE-2025-69261 · OSV

UBUNTU-CVE-2025-69261 · OSV

Track software like this

Free during beta