CVE-2025-61670: Memory Leak in Wasmtime C/C++ API WebAssembly GC Reference Handling

Vulnerability ID: CVE-2025-61670
CVSS Score: 3.3
Published: 2026-07-14

A technical analysis of CVE-2025-61670, a memory leak vulnerability in Wasmtime's C and C++ API bindings. The issue stems from a refactoring in version 37.0.0 that transitioned garbage-collected reference tracking to host heap-allocated OwnedRooted types without updating FFI ownership semantics.

TL;DR

A memory leak in Wasmtime v37.0.0-37.0.1 C/C++ bindings allows local guest modules to exhaust host memory and cause a denial of service.

Technical Details

• CWE ID: CWE-772
• Attack Vector: Local (AV:L)
• CVSS v3.1: 3.3 (Low)
• EPSS Score: 0.00178 (0.18% probability)
• Impact: Availability (Memory Exhaustion / DoS)
• Exploit Status: No public PoC
• KEV Status: Not listed

Affected Systems

• Wasmtime C and C++ API bindings
• Downstream bindings utilizing C APIs (e.g. wasmtime-py)
• Wasmtime: >= 37.0.0, <= 37.0.1 (Fixed in: 37.0.2)

Mitigation Strategies

• Upgrade Wasmtime to version 37.0.2 or higher.
• Avoid using GC-managed values (anyref, externref) over C/C++ boundaries, substituting primitive index handles instead.

Remediation Steps:

1. Update build dependencies (e.g., Cargo, CMake) to pull Wasmtime v37.0.2 or later.
2. Recompile the C/C++ host application using the updated headers to inherit the corrected RAII destructors.
3. Run runtime tests using AddressSanitizer or Valgrind to verify that GC reference lifecycles are correctly reclaimed upon scope exit.

References

• Bytecode Alliance Security Advisory GHSA-vvp9-h8p2-xwfc
• Wasmtime Fix Commit adff9d9d0f09569203709d5687e5a7dc8e1ad0a3
• Wasmtime Release v37.0.2
• NVD CVE-2025-61670
• CVE.org CVE-2025-61670

Read the full report for CVE-2025-61670 on our website for more details including interactive diagrams and full exploit analysis.