{"id":"CVE-2025-61670","summary":"Wasmtime has memory leak in C API with `externref` and `anyref` types","details":"Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the `anyref` or `externref` WebAssembly values. This is caused by a regression introduced during the development of 37.0.0 and all prior versions of Wasmtime are unaffected. If `anyref` or `externref` is not used in the C/C++ API then embeddings are also unaffected by the leaky behavior. The `wasmtime` Rust crate is unaffected by this leak.\n\nDevelopment of Wasmtime 37.0.0 included a refactoring in Rust of changing the old `ManuallyRooted\u003cT\u003e` type to a new `OwnedRooted\u003cT\u003e` type. This change was integrated into Wasmtime's C API but left the C API in a state which had memory leaks. Additionally the new ownership semantics around this type were not reflected into the C++ API, making it leak-prone. A short version of the change is that previously `ManuallyRooted\u003cT\u003e`, as the name implies, required manual calls to an \"unroot\" operation. If this was forgotten then the memory was still cleaned up when the `wasmtime_store_t` itself was destroyed eventually. Documentation of when to \"unroot\" was sparse and there were already situations prior to 37.0.0 where memory would be leaked until the store was destroyed anyway. All memory, though, was always bound by the store, and destroying the store would guarantee that there were no memory leaks.\n\nIn migrating to `OwnedRooted\u003cT\u003e` the usage of the type in Rust changed. A manual \"unroot\" operation is no longer required and it happens naturally as a destructor of the `OwnedRooted\u003cT\u003e` type in Rust itself. These new resource ownership semantics were not fully integrated into the preexisting semantics of the C/C++ APIs in Wasmtime. A crucial distinction of `OwnedRooted\u003cT\u003e` vs `ManuallyRooted\u003cT\u003e` is that the `OwnedRooted\u003cT\u003e` type allocates host memory outside of the store. This means that if an `OwnedRooted\u003cT\u003e` is leaked then destroying a store does not release this memory and it's a permanent memory leak on the host.\n\nThis led to a few distinct, but related, issues arising: A typo in the `wasmtime_val_unroot` function in the C API meant that it did not actually unroot anything. This meant that even if embedders faithfully call the function then memory will be leaked. If a host-defined function returned a `wasmtime_{externref,anyref}_t` value then the value was never unrooted. The C/C++ API no longer has access to the value and the Rust implementation did not unroot. This meant that any values returned this way were never unrooted. The goal of the C++ API of Wasmtime is to encode automatic memory management in the type system, but the C++ API was not updated when `OwnedRooted\u003cT\u003e` was added. This meant that idiomatic usage of the C++ API would leak memory due to a lack of destructors on values.\n\nThese issues have all been fixed in a 37.0.2 release of Wasmtime. The implementation of the C and C++ APIs have been updated accordingly and respectively to account for the changes of ownership here. For example `wasmtime_val_unroot` has been fixed to unroot, the Rust-side implementation of calling an embedder-defined function will unroot return values, and the C++ API now has destructors on the `ExternRef`, `AnyRef`, and `Val` types. These changes have been made to the 37.0.x release branch in a non-API-breaking fashion. Changes to the 38.0.0 release branch (and `main` in the Wasmtime repository) include minor API updates to better accommodate the API semantic changes. The only known workaround at this time is to avoid using `externref` and `anyref` in the C/C++ API of Wasmtime. If avoiding those types is not possible then it's required for users to update to mitigate the leak issue.","aliases":["GHSA-vvp9-h8p2-xwfc","PYSEC-2025-268"],"modified":"2026-10-28T11:00:14.618076531Z","published":"2025-10-07T18:49:53.869Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61670.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-772"]},"references":[{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v37.0.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61670.json"},{"type":"ADVISORY","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vvp9-h8p2-xwfc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61670"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bytecodealliance/wasmtime","events":[{"introduced":"7b3d6ae79e9153a2477668062f5622c10333925f"},{"fixed":"7a95dd3259f40707966445e9c32d8e1a3bf9b326"},{"fixed":"adff9d9d0f09569203709d5687e5a7dc8e1ad0a3"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"37.0.0"},{"fixed":"37.0.2"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"adff9d9d0f09569203709d5687e5a7dc8e1ad0a3"}]},{"range":[{"fixed":"7a95dd3259f40707966445e9c32d8e1a3bf9b326"}],"source":"REFERENCES_TAG","original_tag":"v37.0.2"}]}}],"versions":["37.0.0","37.0.1","v37.0.1","v37.0.0"],"database_specific":{"vanir_signatures_modified":"2026-10-28T11:00:14Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-61670.json","vanir_signatures":[{"id":"CVE-2025-61670-0a94ea56","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/linking.c","function":"read_wat_file"},"deprecated":false,"digest":{"function_hash":"239038250953443979776037684010123981118","length":623}},{"id":"CVE-2025-61670-126a2a64","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/include/wasmtime/val.hh"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["1539636071088475761271501389735690170","202280017842886777161336071364430178759","245420630537766729263589258523551359799","121922619957923171701000727503082051617","117606466560574167169502258684100076027","273927136556547083894740994943530651046","326347702878535458112167853011593939333","177943905407205378835001382241058416108","195725604853579818220660413879530718418","73381601307961683122498160152921845957","22407344896013257401274119309773115248","246958202002346833618572286861129460670","268362116943033474798921688332187156051","144629046543482296879011637992510624628","79307799226460247638321950031163039757","34160796396154798055588914820779950312","110269825477982384747082875521711477014","133359771295494434113385502098957970101","295685618337758413568784100524640709756","183608819447028077018588748184091393768","58090359573668769466372093203111201591","151666790149815128475758143498495510235","170140036214424582401685727262750337687","168396023086393001437003535517460338399","51402073927974074500325167490137088941","208933156753303184343878060010039307693","287323649330925776894222205700521391632","193818306674907620129557046567249454358","130848518871737478987876835701279045086","231830920624747344374247116056988707177","99437803915501699995806951919063377226","302102692915384062550529652336090956457","71608320222380317626208701344350246070","192608625071767999180454164960543331894","315727110438839264717263120064566020320","60439935921873870870160738336591664959","97697815921122475283825954234583488237","137755720758885462451019669273482012507","202007932815018339842238699521202760726","118073576258846537018657328685882213729","37200871060491150511332459273724466025","124482216885936197082003902494948658490","106729139459858681163232615887539465263","48951169713339684931934382079166698760","287874011444583552840204929381141828619","127274861278382954655432875173660055196","5180740105952222281683202050628666728","138616980595684969351541715496611687059","29306367623286198976955350474624614771","171524987274869128991859411480127468940","250304328789518460913283973034958300828","158473435543375922717220027213356072712","242130368924215313304020373683716910219","144350394220423014066568618444887168237","196575107834987647605937848654150052244","101762382403458101772126373533809643005","185661521158047459238714116007834150492","93453456329994913049942789669454462677","73835743055820428817273873502255413799","270834612007571598164451880362591954289","10033196504580886054916381611960841204"]}},{"id":"CVE-2025-61670-13e3d56a","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"function":"TEST","file":"crates/c-api/tests/component/call_func.cc"},"deprecated":false,"digest":{"length":1856,"function_hash":"3386366889517654830900757931282440789"}},{"id":"CVE-2025-61670-211389a3","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/anyref.cc"},"deprecated":false,"digest":{"line_hashes":["281636230982690574565996862181999270078","55998348253461067977918164250936377167","87615399329177124453644051340795360391","177469211927663071480343211343627645348","303496817182978929185209101407752899742","117320827620453740261762747723104282334","211288138567783224172120535917590431813","283382335213161466236018024834531103411","192839634238902332182286561531662197194","253803036842026095501384463490416049730","265729264152771178974356876547635159879","225312969560913132350157655513471375124","325875087968488062302278732235656382828","183582510547442134481938977819219539318","311649045907350042241078015558668630370","289601007116746533792038521655408641138"],"threshold":0.9}},{"source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"function":"main","file":"examples/linking.c"},"deprecated":false,"digest":{"length":1971,"function_hash":"97749667397886942190810761839215853557"},"id":"CVE-2025-61670-312e6276","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/include/wasmtime/func.hh","function":"store"},"deprecated":false,"digest":{"function_hash":"287065451800367318930751320798871806799","length":209},"id":"CVE-2025-61670-32ba296e","signature_type":"Function"},{"target":{"file":"crates/c-api/tests/wasip2.cc"},"deprecated":false,"digest":{"line_hashes":["77766655332018131655520996335915930130","9357118980929513202397500719899514158","156639384664556887526941084303078631296","228993093352600687512056374232140550449"],"threshold":0.9},"id":"CVE-2025-61670-347dae0c","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3"},{"target":{"function":"TEST","file":"crates/c-api/tests/func.cc"},"deprecated":false,"digest":{"function_hash":"72594247815070258707741804395519645848","length":4133},"id":"CVE-2025-61670-34f160fe","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3"},{"digest":{"function_hash":"279126106388697285181870826955548015344","length":3515},"id":"CVE-2025-61670-367345ce","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"function":"main","file":"examples/externref.c"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["327833103535599018587100778939797918775","283366378722565153886485441532750171848","33585783551247361001061056133210512147","244097306390175757044630189762048500535","68846363239376570894735820982922415291","277815760493109594890836158135687507702","187156497876686230317163643180091518390","159717292452880939312448430221668065146"],"threshold":0.9},"id":"CVE-2025-61670-37622ac7","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/hello.c"}},{"source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/tests/component/define_module.cc"},"deprecated":false,"digest":{"line_hashes":["138798311914969214564375182116661752153","146608347529087581120682969483395862879","24014619031820812355558864524067332263","257705988896628119222448346367973554630","77766655332018131655520996335915930130","9357118980929513202397500719899514158","156639384664556887526941084303078631296","228993093352600687512056374232140550449"],"threshold":0.9},"id":"CVE-2025-61670-3aacb893","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/serialize.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["327833103535599018587100778939797918775","283366378722565153886485441532750171848","33585783551247361001061056133210512147","244097306390175757044630189762048500535","68846363239376570894735820982922415291","277815760493109594890836158135687507702","187156497876686230317163643180091518390","159717292452880939312448430221668065146"]},"id":"CVE-2025-61670-3bff1773","signature_type":"Line","signature_version":"v1"},{"target":{"function":"hello_callback","file":"examples/serialize.c"},"deprecated":false,"digest":{"function_hash":"130172377908366107833124579878745766553","length":210},"id":"CVE-2025-61670-3efba06c","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3"},{"digest":{"line_hashes":["203184405781699784215635001682468757128","177377563439105819574903396931967270413","97551931936973954330975771885080937590","267899763732771338040844618139965668376","103602472259155667999131327923701941","155696221914348648478513230269743254320","15812577225273489263869762066235728623"],"threshold":0.9},"id":"CVE-2025-61670-40389f48","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/tests/func.cc"},"deprecated":false},{"source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/fib-debug/main.c"},"deprecated":false,"digest":{"line_hashes":["180583778601970458510234087183019259811","288435081160744588087772658287310043221","25888796511390980101087550159796351339","260094651728753213574853883459875760758"],"threshold":0.9},"id":"CVE-2025-61670-43f0d4cd","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2025-61670-49670135","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/anyref.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["311791095344432233896929177857448030535","151360866558810429166894415915509884939","246984357734258602194926730585980722277","103499532884620619702414752887967585161","216265213713227423504792069430925576210","191561323713360916586542108548857924364","215082816980025098037411290339807498207","200140265575093769053044997017236586467","158770433927401890482139169340993201150","265436580850444874691765338222457602555","207006353683284052455433759760628288787","92497323470318700288325401915024645266","160051913977858569861358276066219580760"]}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["224898079757763304564177008264326986020","168254136822790001041879452232769057600","156536689535008541136702246714871203134","288515495947418872438986995344836497093"]},"id":"CVE-2025-61670-4ce7f893","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/include/wasmtime/store.hh"}},{"deprecated":false,"digest":{"function_hash":"256470808725184742693791582430940839411","length":1570},"id":"CVE-2025-61670-51157091","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/externref.cc","function":"main"}},{"source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/tests/simple.cc","function":"TEST"},"deprecated":false,"digest":{"length":298,"function_hash":"241469295356491930855411478137126939313"},"id":"CVE-2025-61670-523a44da","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/threads.c"},"deprecated":false,"digest":{"line_hashes":["235886311106327037321880099265340433360","265606457956788435352008785403599868864","76079536550098549391394225619859052737","114104416927874574798023564688814095645","191880617509049790508269194760411118390","145445935307544987024330387339762111567","254218545959826101463814404445063907535","128262829326089299509415778687800798272"],"threshold":0.9},"id":"CVE-2025-61670-5c445b93","signature_type":"Line","signature_version":"v1"},{"target":{"file":"examples/multi.c","function":"callback"},"deprecated":false,"digest":{"function_hash":"186315563336212835568250346235407421690","length":340},"id":"CVE-2025-61670-5effb468","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3"},{"id":"CVE-2025-61670-5fdf5592","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/multi.c","function":"main"},"deprecated":false,"digest":{"function_hash":"19264699883013785367064049247951148379","length":2467}},{"source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/tests/component/lookup_func.cc","function":"TEST"},"deprecated":false,"digest":{"length":1325,"function_hash":"271309926711863051943075270055434153494"},"id":"CVE-2025-61670-641d362d","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2025-61670-66bddeab","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/fuel.c","function":"main"},"deprecated":false,"digest":{"function_hash":"131416095267361906370891594560481311594","length":2302}},{"id":"CVE-2025-61670-67c5279c","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/tests/component/call_func.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["109646761112963135440039868149723910642","277673079691899924276725036014953586937","48968276650467836560216647520782732632","228993093352600687512056374232140550449"]}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["161922376177555521209378958695445234228","20755879162250323689848541838578054544","129485960807809268010850816529613379315","187250478735286047208103379690090606948","274437742227702155972654970344765638676","16791665294981254976639848724327079663","45396831518796970290258071417765494032","229289187351512377817967472332824026799","168548327183583255085405179863377093133","66683602636950528637709141103372684076","249289771791047943496354595860298115662","163952452176921603347308337827883232161"]},"id":"CVE-2025-61670-680bc2f9","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/multi.c"}},{"digest":{"line_hashes":["156612903066509447911483115207954099671","270792311464176667848847388108118811222","48968276650467836560216647520782732632","228993093352600687512056374232140550449"],"threshold":0.9},"id":"CVE-2025-61670-686dac79","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/tests/component/lookup_func.cc"},"deprecated":false},{"target":{"file":"examples/anyref.cc","function":"main"},"deprecated":false,"digest":{"function_hash":"334796554231022768052459003790237120130","length":2405},"id":"CVE-2025-61670-6f931213","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3"},{"source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/wasip1/main.c","function":"main"},"deprecated":false,"digest":{"function_hash":"66458168728415241524821076957892428517","length":1696},"id":"CVE-2025-61670-72790f12","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/externref.c"},"deprecated":false,"digest":{"line_hashes":["77566750368483985976795887680601725768","329136920325381753252960003384512656676","70108304270269964620407107656515391035","315611087137574356861024801278673184275","154204285860676903507569248533184615932","331790829797402943882340850795900725251","207550839419374979678814837075753941724","136513091277801952702248408735052157797","158141313505179103204984770789744320153","337393460470967309346362426032361849314","262798952250109939170877653187179891171","61057397274042202735404666881228604401","301073042999582812250314154763460925532","59558759863939478840152232550119987480"],"threshold":0.9},"id":"CVE-2025-61670-7284fd99","signature_type":"Line"},{"digest":{"function_hash":"191841505628206816341079954460350653126","length":1611},"id":"CVE-2025-61670-78cb2143","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/interrupt.c","function":"main"},"deprecated":false},{"source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/include/wasmtime/val.h"},"deprecated":false,"digest":{"line_hashes":["114840428163196700945646720018216867821","233460180292402181037151399258686461190","31674951613549443352876659830307505753","70564616964847033930241967320010631503","121624554233926054235425847746188873131","103133931766694967725977521872726464748","104157151181730359322996130369800275557","297252937990131845517552614283528707197","177849942578825139274353397589225563645","215184076918890812037686769111978777052","193213285210548510020678557439295630790","191454038240556243926867136034745114846","40019116671850068089146883719566678008","161348281757705724995660566446635924063","215879430837435920727415759810551725473","195905397742529488796530006042959621757","20301727398942959668614714512485003153","216015329531504607939195653514812671074","292460814415326607003289557092820711867","74408137119890479624896909000540451940","266907187336241060707236931656377787846","138045932249551830122998867504773762422","240517502983004434107129874639294182764"],"threshold":0.9},"id":"CVE-2025-61670-798c18ae","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"310592803155591736493956482831564618935","length":775},"id":"CVE-2025-61670-7d56ef8f","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/tests/component/instantiate.cc","function":"TEST"},"deprecated":false},{"id":"CVE-2025-61670-872a0cc2","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/fib-debug/main.c","function":"main"},"deprecated":false,"digest":{"function_hash":"111865219520797838742041944755378232464","length":2173}},{"deprecated":false,"digest":{"function_hash":"279930480565143217902102054163008066903","length":1421},"id":"CVE-2025-61670-8e1393cf","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"function":"main","file":"examples/threads.c"}},{"source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/fuel.c"},"deprecated":false,"digest":{"line_hashes":["290630008375835217478623462414587769891","57637742170203601018926416411439045982","66338951341665873305407264727427793536","141289690566646623527892847482391044632","235485205121596475199564590701037764294"],"threshold":0.9},"id":"CVE-2025-61670-915721bd","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2025-61670-933a5f2b","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/tests/val.cc","function":"TEST"},"deprecated":false,"digest":{"function_hash":"91000604233444738355696633859792469397","length":2302}},{"signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/include/wasmtime/func.hh"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["195400099034154476133480365874375549069","240750240563837692319908360549103097277","335240993552294711666990225916353338951","7218740632512893057504349179363417206","261218482663245237780612615473197856501","21063579403537326417566571916901673259","239741828280080250612742787242978522265","50414265203910099869574888442125804928","310083116992658765654132527256247387730","30509746464990316643431853401697248863","331318874541863831857081291153836636804","166793712896820615271536644967157150222","184302772951246810638129334464477015478","130246021487282655048962645179199106987","66045663825187151956325075792822440378","211304801468185716670921720993189482226","6305319697366725372476498169233607195","72681213663818739828800791987643961142","260284760955877116731215954957498199617","57425005992871491024753326095430934838"]},"id":"CVE-2025-61670-a06ee313","signature_type":"Line"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["297466132329909563085956763350899476170","110834722722270291672905165132932162599","94597242398268288400074356479693908916","70439728160943585611541219348243324361","3165870098935666870783044537898357775","237740150181855399247098382916605954225","84869650236102558176526008173632211068","119296684058085238336235726941696458949","166114888177654484026170144136305415085","269309562499494592692238296921025510550","158438673656734168078070029158908298858","55992249969090541203872367244700850062","260284633411987745508417961878061026555","153208273439918791518368531607240351047","287300967335607216799652173481708219177","266773622020625550294274964237300503184","137679006804210181895073327396629289420","92644920078478417453575952142532701601","181267662717590856478373623125004152695","135751964205585184404307497829234020027","189429866090299371808652361313779162116","33129901361646549559354094343193236456"]},"id":"CVE-2025-61670-a32bf916","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/tests/val.cc"}},{"deprecated":false,"digest":{"line_hashes":["155740160241245062684289129554899217163","274807709480807300621892652921995531190","235936488269419013362301296321671775385","102297373283049316013052941462098509473"],"threshold":0.9},"id":"CVE-2025-61670-a7b3699f","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/tests/simple.cc"}},{"deprecated":false,"digest":{"length":3844,"function_hash":"128289557685912890674923718481782659328"},"id":"CVE-2025-61670-aa5e2313","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/memory.c","function":"main"}},{"digest":{"threshold":0.9,"line_hashes":["4080467440490755817595560994959619751","201471988775449496666419609329109334482","249289771791047943496354595860298115662","163952452176921603347308337827883232161"]},"id":"CVE-2025-61670-add2d479","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/memory.c"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["254543982338825933390882011430886147853","187255372633711252624763062546659546483","331405379961275344219621132793265762866","126993152517407769790208073439696784242","58329760137976800584683905807908963914","192626668190020590808254970780102604768","80178027127666578463616190237800337962","266600364127563446309850209869628280237","307251874823067339971003353749490088839","313848699820048751069326345786958119060","94020730231012292190635132280381857651","256634557156306598151067577642211399326","183131535472026867148228766379845586142","238785262346813878585746344318374408880","213641728818270061891559956122147200724","143750048590047023378973631592108801145"],"threshold":0.9},"id":"CVE-2025-61670-c0c107aa","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/externref.cc"}},{"digest":{"function_hash":"29726346071899979322721609055102597888","length":858},"id":"CVE-2025-61670-c74ac33b","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/tests/wasip2.cc","function":"TEST"},"deprecated":false},{"digest":{"line_hashes":["103247954601109459827439298361169189959","88193762936416258935262211887220828654","335699330162213532100071882971380642038"],"threshold":0.9},"id":"CVE-2025-61670-cdd49cee","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/include/wasmtime/error.hh"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/serialize.c","function":"deserialize"},"deprecated":false,"digest":{"function_hash":"291237301097159691107361908635891887932","length":1348},"id":"CVE-2025-61670-cff0840a","signature_type":"Function"},{"id":"CVE-2025-61670-d8602854","signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"function":"closure_callback","file":"examples/multi.c"},"deprecated":false,"digest":{"length":318,"function_hash":"33325619724730017958982306035875432806"}},{"source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/wasip1/main.c"},"deprecated":false,"digest":{"line_hashes":["141132880786133170773034471131430431899","34377469649759624311174259355948408005","60031994141765551974376829056574902254"],"threshold":0.9},"id":"CVE-2025-61670-d9af5556","signature_type":"Line","signature_version":"v1"},{"target":{"file":"crates/c-api/tests/component/instantiate.cc"},"deprecated":false,"digest":{"line_hashes":["338014730825625017262198933162327071535","4298359228070217431441650640082847492","174026454356923402620126573971491484669","228993093352600687512056374232140550449"],"threshold":0.9},"id":"CVE-2025-61670-ddddd70e","signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/linking.c"},"deprecated":false,"digest":{"line_hashes":["283448127530105019765430929819565867416","62435082242828069672051252137148107799","227643792110934379502678983351957407547","235198368444162444072480328756825152531","135082574868719374485572020762533078008","84577054864608704945401046803675193255","280571048211362552669037300559110214414","107214548317158337090368915174406099047","324012361487711828901301526297578632840","234172514480381095946574097466172831847","333869398692891498171025847637069051742","169028161277299052905043211518724409101","247820777145861814787789751594211745611","206656002848403896548431878540182458881","196253629316873493187065598066836360528"],"threshold":0.9},"id":"CVE-2025-61670-e102cb3b"},{"signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/threads.c","function":"callback"},"deprecated":false,"digest":{"function_hash":"100649482660398747285071169360457804122","length":139},"id":"CVE-2025-61670-e2459473","signature_type":"Function"},{"source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/hello.c","function":"hello_callback"},"deprecated":false,"digest":{"function_hash":"130172377908366107833124579878745766553","length":210},"id":"CVE-2025-61670-ec586692","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/hello.c","function":"main"},"deprecated":false,"digest":{"length":1906,"function_hash":"76820343168440923426926637402103799127"},"id":"CVE-2025-61670-f1d3c0c1"},{"signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/interrupt.c"},"deprecated":false,"digest":{"line_hashes":["202662241157244468080704785493091146067","92485375978599869562638779582459551655","328686204915383677653849487743462593552","155797797926227884217376768838044204129"],"threshold":0.9},"id":"CVE-2025-61670-fa6e0ad6","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"crates/c-api/tests/component/define_module.cc","function":"TEST"},"deprecated":false,"digest":{"function_hash":"47109813528394916185042643057489944429","length":1546},"id":"CVE-2025-61670-feb7fdb7","signature_type":"Function"},{"source":"https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","target":{"file":"examples/anyref.c","function":"main"},"deprecated":false,"digest":{"function_hash":"30807512783820893787951119236684096393","length":3990},"id":"CVE-2025-61670-ff97d429","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L"}]}