Race Condition Affecting wasmtime package, versions <24.0.5>=26.0.0 <36.0.3>=37.0.0 <37.0.3>=38.0.1 <38.0.4
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-WASMTIME-13923298
- published13 Nov 2025
- disclosed12 Nov 2025
- creditUnknown
Introduced: 12 Nov 2025
NewCVE-2025-64345 (opens in a new tab)How to fix?
Upgrade wasmtime to version 24.0.5, 36.0.3, 37.0.3, 38.0.4 or higher.
Overview
Affected versions of this package are vulnerable to Race Condition via the Memory::new function and during core dump generation. An attacker can cause data races and unsound memory access by creating shared linear memories using inappropriate constructors or by exposing shared memory contents through unsynchronized core dumps.
Note: This is only exploitable if shared memories are made and accessed across threads.
Workaround
This vulnerability can be mitigated by using SharedMemory::new instead of Memory::new for shared memories and by disabling core dumps.