bytecodealliance

Records98All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical8CVSS 9.0–10.0

CVSS high19CVSS 7.0–8.9

Exploited now

bytecodealliance records in CISA KEV

No bytecodealliance vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Wasmtime 41 records MEDIUM Webassembly Micro Runtime 11 records HIGH Cranelift-codegen 6 records MEDIUM Lucet 1 record MEDIUM

Records

98 records

TI-2026-85541 CVE-2026-54912

WAMR fast interpreter loader heap overflow via constant deduplication mismatch

HIGH 73

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00451 Published 2026-11-05 Fixed in 2.4.5 CWE-787

TI-2024-16741 CVE-2024-25431 · GHSA-gf29-gwj9-7xvj

An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit…

HIGH 73

An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privileges via a crafted file to the check_was_abi_compatibility function.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00656 Published 2024-11-08 No fix listed CWE-125

TI-2024-22658 CVE-2024-34251 · GHSA-v4vq-27w6-p28p

An out-of-bound memory read vulnerability was discovered in Bytecode Alliance…

HIGH 72

An out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause a denial of service via the "block_type_get_arity" function in core/iwasm/in…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00758 Published 2024-05-06 No fix listed CWE-125

TI-2024-18300 CVE-2024-27532 · GHSA-7h2g-q5x6-pwg2

wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL…

HIGH 72

wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL Pointer Dereference in function `block_type_get_result_types.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00514 Published 2024-11-08 No fix listed CWE-476

TI-2023-26034 CVE-2023-48105 · GHSA-w252-369w-2g4v

An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime…

HIGH 72

An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of service via the wasm_loader_prepare_bytecode function in core/iwasm/interpreter/…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01 Published 2023-11-22 No fix listed CWE-787

TI-2025-33969 CVE-2025-54126

WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified

HIGH 70

The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00723 Published 2025-07-29 Fixed in 2.4.1 CWE-668

TI-2024-22657 CVE-2024-34250 · GHSA-7wfw-7p9h-4j2c

A heap buffer overflow vulnerability was discovered in Bytecode Alliance…

HIGH 67

A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause at least a denial of service via the "wasm_loader_check_br" function in core/iwas…

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.00332 Published 2024-05-06 No fix listed CWE-122

TI-2025-40059 CVE-2025-64713

Memory corruption in bytecodealliance wasm-micro-runtime

HIGH 66

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime.

CVSS 3.1HIGH 7.4 Local No auth No interaction EPSS 0.00351 Published 2025-11-25 Fixed in 2.4.4 CWE-119

TI-2026-21632 CVE-2026-27195 · GHSA-xjhv-v822-pf94

Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

MEDIUM 64

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00412 Published 2026-02-24 Partial fix · 40.0.4, 41.0.4 CWE-755

TI-2025-28437 CVE-2025-43853

iwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi feature

MEDIUM 64

The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface.

CVSS 4.0HIGH 7.0 Local No auth No interaction EPSS 0.00293 Published 2025-05-15 Fixed in 2.3.0 CWE-61

TI-2024-29400 CVE-2024-43806 · GHSA-c827-hfw6-qwvm

`rustix::fs::Dir` iterator with the `linux_raw` backend can cause memory explosion

MEDIUM 62

Rustix is a set of safe Rust bindings to POSIX-ish APIs.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0048 Published 2024-08-26 Fixed in 0.35.15, 0.36.16 +2 CWE-400

TI-2025-40050 CVE-2025-64704

WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction

MEDIUM 58

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00202 Published 2025-11-25 Fixed in 2.4.4 CWE-754

TI-2026-80003 CVE-2026-115893 · GHSA-mghf-wjfp-p5xm

Cranelift on aarch64 jumps to wrong target in large Wasmtime br_table

MEDIUM 45

Wasmtime is a runtime for WebAssembly.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0099 Published 2026-10-23 Partial fix · 36.0.19, 48.0.7 +1 CWE-691

TI-2023-11636 CVE-2023-26489 · GHSA-ff4p-7xrq-q5r8

Guest-controlled out-of-bounds read/write on x86_64 in wasmtime

MEDIUM 45

wasmtime is a fast and secure runtime for WebAssembly.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.01251 Published 2023-03-08 Fixed in 4.0.1, 5.0.1 +4 CWE-125

TI-2022-18765 CVE-2022-39393 · GHSA-wh6w-3828-g9qf

Wasmtime vulnerable to data leakage between instances in the pooling allocator

MEDIUM 45

Wasmtime is a standalone runtime for WebAssembly.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00939 Published 2022-11-10 Fixed in 2.0.2, 1.0.2 CWE-226

TI-2022-08604 CVE-2022-24791 · GHSA-gwc9-348x-qwv2

Use after free in Wasmtime

MEDIUM 45

Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01179 Published 2022-03-31 Fixed in 0.34.2, 0.35.2 CWE-416

TI-2025-36407 CVE-2025-58749

WAMR runtime hangs or crashes with large memory.fill addresses in LLVM-JIT mode

MEDIUM 44

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime.

CVSS 4.0LOW 2.1 Local No auth No interaction EPSS 0.00369 Published 2025-09-16 Fixed in 2.4.2 CWE-190

TI-2026-80001 CVE-2026-115889 · GHSA-897f-g5gm-fmxm

Silent overflow in Wasmtime Cranelift compiler causes miscompilation

MEDIUM 43

Wasmtime is a runtime for WebAssembly.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00454 Published 2026-10-23 Partial fix · 36.0.19, 43.0.0 CWE-197

TI-2026-79469 CVE-2026-115384 · GHSA-6fff-wrjr-wjxr

Stack buffer overflow in Wasmtime async callbacks

MEDIUM 42

Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00312 Published 2026-10-22 Fixed in 48.0.4, 49.0.2 CWE-20

TI-2022-18766 CVE-2022-39394 · GHSA-h84q-m8rr-3v9q

wasmtime_trap_code C API function has out of bounds write vulnerability

MEDIUM 42

Wasmtime is a standalone runtime for WebAssembly.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00423 Published 2022-11-10 Fixed in 2.0.2, 1.0.2 CWE-787

TI-2026-27209 CVE-2026-34987 · GHSA-xx5w-cvp6-jv83

Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access

MEDIUM 41

Wasmtime is a runtime for WebAssembly.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.00283 Published 2026-04-09 Fixed in 36.0.7, 42.0.2 +2 CWE-125

TI-2026-27193 CVE-2026-34971 · GHSA-jhxm-h53p-jm7w

Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

MEDIUM 41

Wasmtime is a runtime for WebAssembly.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.00324 Published 2026-04-09 Partial fix · 36.0.7, 42.0.2 +2 CWE-125

TI-2022-13189 CVE-2022-31146 · GHSA-5fhj-g3p3-pq9g

Use After Free in Wasmtime

MEDIUM 41

Wasmtime is a standalone runtime for WebAssembly.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0125 Published 2022-07-20 Fixed in 0.38.2, 0.85.2 CWE-416

TI-2026-82176 CVE-2026-118688 · GHSA-63fr-xrxj-8wrx

Symlink following in Wasmtime lets guests escape sandbox via rename

MEDIUM 40

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks.

CVSS 4.0HIGH 8.8 Network Low privileges User interaction EPSS 0.00242 Published 2026-10-28 Fixed in 36.0.18, 48.0.6 +1 CWE-61

TI-2026-79477 CVE-2026-115392 · GHSA-gxhv-gf3j-vwqc

Sandbox escape in Wasmtime WASI via symlinks with trailing slashes

MEDIUM 40

Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes…

CVSS 4.0HIGH 8.8 Network Low privileges User interaction EPSS 0.00242 Published 2026-10-22 Fixed in 24.0.13, 36.0.14 +2 CWE-61

Open these records in search →