The Wasmi WebAssembly interpreter is vulnerable to a use-after-free flaw that could allow for memory corruption, information disclosure, or arbitrary code execution.

This is a use-after-free vulnerability (CWE-416) within the linear memory implementation of the interpreter. The flaw is triggered when a malicious or malformed WebAssembly module initiates specific memory growth sequences, allowing an unauthenticated attacker to corrupt memory.

The exploitation of this vulnerability poses a severe risk to the integrity and confidentiality of systems utilizing the Wasmi interpreter. With a CVSS score of 8.4, the potential for arbitrary code execution and unauthorized information disclosure could lead to complete system compromise, depending on the privileges of the host application.

Immediate Action: Update the Wasmi crate to the fixed versions: 0.41.2, 0.47.1, 0.51.3, or 1.0.1.

Proactive Monitoring: Monitor application logs for unexpected crashes or memory access violations that may indicate exploitation attempts against the WebAssembly runtime.

Compensating Controls: If immediate patching is not feasible, restrict the maximum linear memory size for WebAssembly modules to mitigate the conditions required to trigger the memory growth bug.

Public Exploit Available: Unknown

Given the potential for code execution and the high severity CVSS rating, security teams should prioritize upgrading to the patched versions of Wasmi immediately. Organizations relying on this interpreter for sandboxing untrusted code must consider the risk of memory corruption until the update is fully deployed across their environment.