CVE-2025-69261

Publication date 30 December 2025

Last updated 7 January 2026

Ubuntu priority

Description

WasmEdge is a WebAssembly runtime. Prior to version 0.16.0-alpha.3, a multiplication in `WasmEdge/include/runtime/instance/memory.h` can wrap, causing `checkAccessBound()` to incorrectly allow the access. This leads to a segmentation fault. Version 0.16.0-alpha.3 contains a patch for the issue.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
wasmedge	25.10 questing	Needs evaluation
	25.04 plucky	Ignored end of life, was needs-triage
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Not in release

How can I get the fixes?
What do statuses mean?

References

MITRE
NVD
Launchpad
Debian

Other references

https://www.cve.org/CVERecord?id=CVE-2025-69261
https://github.com/WasmEdge/WasmEdge/security/advisories/GHSA-89fm-8mr7-gg4m
https://github.com/WasmEdge/WasmEdge/commit/37cc9fa19bd23edbbdaa9252059b17f191fa4d17