Bytecodealliance - vulnerabilities (CVEs)

78 CVEs in 8 products, 20 in the last 30 days, newest from 2026-10-28.

Products

Wasmtime - 57 CVEs
Webassembly Micro Runtime - 11 CVEs
Cranelift-codegen - 6 CVEs
Wasm-micro-runtime - 5 CVEs
Wasm Micro Runtime - 2 CVEs
Cap-std - 1 CVEs
Lucet - 1 CVEs
Rustix - 1 CVEs

Newest CVEs of Bytecodealliance

CVE-2026-118688 - CVSS 8.8 (high), 2026-10-28: wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat…
CVE-2026-115893 - CVSS 9.9 (critical), 2026-10-23: Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction…
CVE-2026-115892 - CVSS 5.7 (medium), 2026-10-23: Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a…
CVE-2026-115889 - CVSS 9.9 (critical), 2026-10-23: Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently…
CVE-2026-115393 - CVSS 3.8 (low), 2026-10-22: Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store…
CVE-2026-115392 - CVSS 8.8 (high), 2026-10-22: Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its…
CVE-2026-115391 - CVSS 6.9 (medium), 2026-10-22: Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers…
CVE-2026-115390 - CVSS 6.9 (medium), 2026-10-22: Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious…
CVE-2026-115389 - CVSS 2.3 (low), 2026-10-22: Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the…
CVE-2026-115388 - CVSS 6.9 (medium), 2026-10-22: wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for…
CVE-2026-115387 - CVSS 6.9 (medium), 2026-10-22: Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest WASI…
CVE-2026-115386 - CVSS 2.6 (low), 2026-10-22: Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir…
CVE-2026-115385 - CVSS 6.9 (medium), 2026-10-22: Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows…
CVE-2026-115384 - CVSS 9.9 (critical), 2026-10-22: Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the…
CVE-2026-115383 - CVSS 5.9 (medium), 2026-10-22: Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import…
CVE-2026-115381 - CVSS 5.9 (medium), 2026-10-22: Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes…
CVE-2026-115382 - CVSS 5.9 (medium), 2026-10-22: Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic…
CVE-2026-115380 - CVSS 5.1 (medium), 2026-10-22: Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0…
CVE-2026-115379 - CVSS 6.9 (medium), 2026-10-22: Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when…
CVE-2026-104855 - CVSS 2 (low), 2026-10-02: Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy,…
CVE-2026-58494 - CVSS 6.5 (medium), 2026-07-08: Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory…
CVE-2026-54786 - CVSS 5 (medium), 2026-07-01: Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; versions 37.0.0 through those before…
CVE-2026-47261 - CVSS 7.5 (high), 2026-06-15: Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and…
CVE-2026-44216 - CVSS 7.5 (high), 2026-05-14: Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked…
CVE-2026-34988 - CVSS 6.3 (medium), 2026-04-09: Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug…
CVE-2026-34987 - CVSS 9.9 (critical), 2026-04-09: Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may…
CVE-2026-35195 - CVSS 6.1 (medium), 2026-04-09: Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components…
CVE-2026-35186 - CVSS 7.5 (high), 2026-04-09: Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating…
CVE-2026-34944 - CVSS 5.7 (medium), 2026-04-09: Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the…
CVE-2026-34971 - CVSS 9 (critical), 2026-04-09: Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64…