CVE-2025-61670 Wasmtime has memory leak in C API with `externref` and `anyref` types

Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the anyref or externref WebAssembly values. This is caused by a regression introduced during the development of 37.0.0 and all prior versions of Wasmtime are unaffected. If...

CVE-2025-61670

CVE-2025-61670 affects Wasmtime 37.0.0 and 37.0.1, where memory leaks occur in the C/C++ API when using bindings for the WebAssembly values anyref/externref. The root cause is a Rust refactor changing ManuallyRooted to OwnedRooted and incomplete propagation of ownership semantics to the C/C++ API...