Wasmtime (Bytecodealliance) - vulnerabilities (CVEs)

57 CVEs, 16 in the last 30 days, 208 known versions, newest CVE from 2026-10-28. Vendor: Bytecodealliance.

CVEs of Wasmtime

CVE-2026-118688 - CVSS 8.8 (high), 2026-10-28: wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat…
CVE-2026-115893 - CVSS 9.9 (critical), 2026-10-23: Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction…
CVE-2026-115892 - CVSS 5.7 (medium), 2026-10-23: Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a…
CVE-2026-115889 - CVSS 9.9 (critical), 2026-10-23: Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently…
CVE-2026-115393 - CVSS 3.8 (low), 2026-10-22: Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store…
CVE-2026-115392 - CVSS 8.8 (high), 2026-10-22: Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its…
CVE-2026-115391 - CVSS 6.9 (medium), 2026-10-22: Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers…
CVE-2026-115389 - CVSS 2.3 (low), 2026-10-22: Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the…
CVE-2026-115390 - CVSS 6.9 (medium), 2026-10-22: Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious…
CVE-2026-115388 - CVSS 6.9 (medium), 2026-10-22: wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for…
CVE-2026-115387 - CVSS 6.9 (medium), 2026-10-22: Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest WASI…
CVE-2026-115386 - CVSS 2.6 (low), 2026-10-22: Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir…
CVE-2026-115385 - CVSS 6.9 (medium), 2026-10-22: Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows…
CVE-2026-115384 - CVSS 9.9 (critical), 2026-10-22: Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the…
CVE-2026-115383 - CVSS 5.9 (medium), 2026-10-22: Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import…
CVE-2026-115382 - CVSS 5.9 (medium), 2026-10-22: Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic…
CVE-2026-115381 - CVSS 5.9 (medium), 2026-10-22: Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes…
CVE-2026-115380 - CVSS 5.1 (medium), 2026-10-22: Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0…
CVE-2026-115379 - CVSS 6.9 (medium), 2026-10-22: Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when…
CVE-2026-104855 - CVSS 2 (low), 2026-10-02: Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy,…
CVE-2026-58494 - CVSS 6.5 (medium), 2026-07-08: Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory…
CVE-2026-54786 - CVSS 5 (medium), 2026-07-01: Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; versions 37.0.0 through those before…
CVE-2026-47261 - CVSS 7.5 (high), 2026-06-15: Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and…
CVE-2026-44216 - CVSS 7.5 (high), 2026-05-14: Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked…
CVE-2026-34987 - CVSS 9.9 (critical), 2026-04-09: Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may…
CVE-2026-35195 - CVSS 6.1 (medium), 2026-04-09: Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components…
CVE-2026-35186 - CVSS 7.5 (high), 2026-04-09: Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating…
CVE-2026-34988 - CVSS 6.3 (medium), 2026-04-09: Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug…
CVE-2026-34943 - CVSS 7.5 (high), 2026-04-09: Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed…
CVE-2026-34946 - CVSS 7.5 (high), 2026-04-09: Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a vulnerability where the…
CVE-2026-34945 - CVSS 6.5 (medium), 2026-04-09: Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part…
CVE-2026-34983 - CVSS 5 (medium), 2026-04-09: Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by…
CVE-2026-34944 - CVSS 5.7 (medium), 2026-04-09: Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the…
CVE-2026-34971 - CVSS 9 (critical), 2026-04-09: Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64…
CVE-2026-34942 - CVSS 6.5 (medium), 2026-04-09: Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component…
CVE-2026-34941 - CVSS 8.1 (high), 2026-04-09: Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string…
CVE-2026-27204 - CVSS 6.9 (medium), 2026-02-24: Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host interfaces are…
CVE-2026-27195 - CVSS 7.5 (high), 2026-02-24: Wasmtime is a runtime for WebAssembly. Starting with Wasmtime 39.0.0, the `component-model-async` feature became the default, which brought with it a new…
CVE-2026-27572 - CVSS 7.5 (high), 2026-02-24: Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields`…
CVE-2026-24116 - CVSS 5.5 (medium), 2026-01-27: Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x86-64 platforms with AVX, Wasmtime's…
CVE-2025-64345 - CVSS 1.8 (low), 2025-11-12: Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where…
CVE-2025-62711 - CVSS 3.1 (low), 2025-10-24: Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in…
CVE-2025-61670 - CVSS 3.3 (low), 2025-10-07: Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the `anyref` or `externref`…
CVE-2025-53901 - CVSS 3.5 (low), 2025-07-18: Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions…
CVE-2024-51745 - CVSS 10 (critical), 2024-11-05: Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such…
CVE-2024-47813 - CVSS 2.9 (low), 2024-10-09: Wasmtime is an open source runtime for WebAssembly. Under certain concurrent event orderings, a `wasmtime::Engine`'s internal type registry was susceptible to…
CVE-2024-47763 - CVSS 5.5 (medium), 2024-10-09: Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime…
CVE-2024-30266 - CVSS 5.5 (medium), 2024-04-04: wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest…
CVE-2023-41880 - CVSS 5.3 (medium), 2023-09-15: Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a miscompilation of the…
CVE-2023-30624 - CVSS 8.8 (high), 2023-04-27: Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as…
CVE-2023-27477 - CVSS 4.3 (medium), 2023-03-08: wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the WebAssembly…
CVE-2023-26489 - CVSS 10 (critical), 2023-03-08: wasmtime is a fast and secure runtime for WebAssembly. In affected versions wasmtime's code generator, Cranelift, has a bug on x86_64 targets where…
CVE-2022-39393 - CVSS 8.6 (high), 2022-11-10: Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance…
CVE-2022-39392 - CVSS 7.4 (high), 2022-11-10: Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator when…
CVE-2022-39394 - CVSS 9.8 (critical), 2022-11-10: Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the…
CVE-2022-31169 - CVSS 7.5 (high), 2022-07-22: Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can…
CVE-2022-31146 - CVSS 8.8 (high), 2022-07-21: Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be…
CVE-2022-31104 - CVSS 5.6 (medium), 2022-06-28: Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x86_64 contained two…
CVE-2022-24791 - CVSS 9.8 (critical), 2022-03-31: Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that…
CVE-2022-23636 - CVSS 8.1 (high), 2022-02-16: Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in…
CVE-2021-39218 - CVSS 6.3 (medium), 2021-09-17: Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness…
CVE-2021-39216 - CVSS 6.3 (medium), 2021-09-17: Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-free bug when…
CVE-2021-39219 - CVSS 6.3 (medium), 2021-09-17: Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the…
CVE-2021-32629 - CVSS 8.8 (high), 2021-05-24: Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable…