Executive brief
Wasmtime is a runtime for executing WebAssembly code. A flaw in its C and C++ interfaces causes memory to leak when handling specific data types, which can eventually lead to system instability or crashes as available memory is exhausted. This issue specifically affects applications using Wasmtime's C/C++ bindings and the anyref or externref features.
Technical details
A regression in Wasmtime 37.0.0 introduced memory leaks in the C and C++ APIs during a refactoring from ManuallyRooted<T> to OwnedRooted<T>. The new OwnedRooted<T> type allocates host memory outside of the Wasmtime store, meaning leaked references are not reclaimed when the store is destroyed. Specific issues include a typo in the wasmtime_val_unroot function, failure to unroot values returned from host-defined functions, and missing destructors in the C++ API for ExternRef, AnyRef, and Val types. An attacker with the ability to execute code that triggers these C/C++ API paths could cause a denial-of-service through memory exhaustion. The issue is fixed in version 37.0.2.
Affected products
- Bytecode Alliance Wasmtime >= 37.0.0, < 37.0.2
- Bytecode Alliance wasmtime-bin < 37.0.2
Timeline
- 2025-10-07: disclosed
- 2025-10-07: patched: Version 37.0.2 released
- 2026-07-14: advisory