CVE-2025-66627 is a Use After Free vulnerability (CWE-416) found in the wasmi WebAssembly interpreter, which is designed for constrained and embedded systems. The vulnerability stems from the linear memory implementation within wasmi, where under certain conditions involving memory growth triggered by a WebAssembly module, a Use After Free condition occurs. This can lead to memory corruption, which attackers can leverage to cause information disclosure or arbitrary code execution. The affected versions include 0.41.0 to 0.41.1, 0.42.0 to 0.47.0, 0.50.0 to 0.51.2, and 1.0.0, with fixes released in 0.41.2, 0.47.1, 0.51.3, and 1.0.1. The vulnerability does not require privileges or user interaction to exploit, increasing its risk profile. The CVSS v3.1 score is 8.4 (high), reflecting the ease of exploitation and severe impact on confidentiality, integrity, and availability. The flaw is particularly critical in embedded systems where wasmi is deployed, as exploitation could compromise device integrity or leak sensitive data. While no active exploits are known, the vulnerability demands prompt attention due to its potential impact on embedded applications relying on WebAssembly execution.

For European organizations, the impact of CVE-2025-66627 can be significant, especially those deploying wasmi in embedded or constrained environments such as IoT devices, industrial control systems, or specialized hardware. Successful exploitation could lead to unauthorized disclosure of sensitive information, disruption of critical services, or full system compromise. This is particularly concerning for sectors like manufacturing, energy, healthcare, and telecommunications, where embedded systems are prevalent and often integral to operational technology. The vulnerability's ability to be exploited without authentication or user interaction increases the risk of automated or remote attacks. Compromise of embedded devices could also serve as a foothold for lateral movement within networks, amplifying the threat. Given the growing adoption of WebAssembly in embedded contexts, the vulnerability could affect a broad range of devices and applications across Europe, potentially impacting national infrastructure and critical services.

European organizations should immediately assess their use of wasmi and identify affected versions within their embedded or constrained systems. The primary mitigation is to upgrade to patched versions: 0.41.2, 0.47.1, 0.51.3, or 1.0.1. Where upgrading is not immediately feasible, organizations should implement strict limits on the maximum linear memory sizes allocated to WebAssembly modules to reduce the risk of triggering the vulnerability. Additionally, applying runtime memory protections and monitoring for anomalous WebAssembly module behavior can help detect exploitation attempts. Network segmentation and strict access controls around devices running wasmi can limit exposure. Organizations should also review supply chain dependencies to ensure no indirect exposure via third-party components. Finally, maintaining up-to-date threat intelligence and preparing incident response plans for potential exploitation scenarios will enhance resilience.