bytecodealliance

Records98All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical8CVSS 9.0–10.0

CVSS high19CVSS 7.0–8.9

Exploited now

bytecodealliance records in CISA KEV

No bytecodealliance vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Wasmtime 41 records MEDIUM Webassembly Micro Runtime 11 records HIGH Cranelift-codegen 6 records MEDIUM Lucet 1 record MEDIUM

Records

41 records in Wasmtime · all components

TI-2026-21632 CVE-2026-27195 · GHSA-xjhv-v822-pf94

Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

MEDIUM 64

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00412 Published 2026-02-24 Partial fix · 40.0.4, 41.0.4 CWE-755

TI-2023-11636 CVE-2023-26489 · GHSA-ff4p-7xrq-q5r8

Guest-controlled out-of-bounds read/write on x86_64 in wasmtime

MEDIUM 45

wasmtime is a fast and secure runtime for WebAssembly.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.01251 Published 2023-03-08 Fixed in 4.0.1, 5.0.1 +4 CWE-125

TI-2022-18765 CVE-2022-39393 · GHSA-wh6w-3828-g9qf

Wasmtime vulnerable to data leakage between instances in the pooling allocator

MEDIUM 45

Wasmtime is a standalone runtime for WebAssembly.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00939 Published 2022-11-10 Fixed in 2.0.2, 1.0.2 CWE-226

TI-2022-08604 CVE-2022-24791 · GHSA-gwc9-348x-qwv2

Use after free in Wasmtime

MEDIUM 45

Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01179 Published 2022-03-31 Fixed in 0.34.2, 0.35.2 CWE-416

TI-2022-18766 CVE-2022-39394 · GHSA-h84q-m8rr-3v9q

wasmtime_trap_code C API function has out of bounds write vulnerability

MEDIUM 42

Wasmtime is a standalone runtime for WebAssembly.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00423 Published 2022-11-10 Fixed in 2.0.2, 1.0.2 CWE-787

TI-2026-27209 CVE-2026-34987 · GHSA-xx5w-cvp6-jv83

Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access

MEDIUM 41

Wasmtime is a runtime for WebAssembly.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.00283 Published 2026-04-09 Fixed in 36.0.7, 42.0.2 +2 CWE-125

TI-2026-27193 CVE-2026-34971 · GHSA-jhxm-h53p-jm7w

Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

MEDIUM 41

Wasmtime is a runtime for WebAssembly.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.00324 Published 2026-04-09 Partial fix · 36.0.7, 42.0.2 +2 CWE-125

TI-2022-13189 CVE-2022-31146 · GHSA-5fhj-g3p3-pq9g

Use After Free in Wasmtime

MEDIUM 41

Wasmtime is a standalone runtime for WebAssembly.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0125 Published 2022-07-20 Fixed in 0.38.2, 0.85.2 CWE-416

TI-2026-27205 CVE-2026-34983 · GHSA-hfr4-7c6c-48w2

Wasmtime has a use-after-free bug after cloning `wasmtime::Linker`

MEDIUM 40

Wasmtime is a runtime for WebAssembly.

CVSS 4.0LOW 1.0 Physical High privileges User interaction EPSS 0.00121 Published 2026-04-09 Partial fix · 43.0.1 CWE-416

TI-2026-34841 CVE-2026-47261 · GHSA-2r75-cxrj-cmph

Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

LOW 39

Wasmtime is a runtime for WebAssembly.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00357 Published 2026-06-15 Partial fix · 44.0.2, 36.0.10 +1 CWE-284

TI-2023-14440 CVE-2023-30624 · GHSA-ch89-5g45-qwc7

Wasmtime has Undefined Behavior in Rust runtime functions

LOW 38

Wasmtime is a standalone runtime for WebAssembly.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0045 Published 2023-04-27 Fixed in 6.0.2, 7.0.1 +1 CWE-758

TI-2022-07688 CVE-2022-23636 · GHSA-88xq-w8cq-xfg7

Invalid drop of partially-initialized instances in wasmtime

LOW 37

Wasmtime is an open source runtime for WebAssembly & WASI.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00772 Published 2022-02-16 Fixed in 0.33.0, 0.34.1 +1 CWE-824

TI-2022-18764 CVE-2022-39392 · GHSA-44mr-8vmm-wjhg

Wasmtime vulnerable to out of bounds read/write with zero-memory-pages configuration

LOW 36

Wasmtime is a standalone runtime for WebAssembly.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00826 Published 2022-11-10 Fixed in 2.0.2, 1.0.2 CWE-119

TI-2022-13211 CVE-2022-31169 · GHSA-7f6x-jwh5-m9r4

Cranelift vulnerable to miscompilation of constant values in division on AArch64

LOW 35

Wasmtime is a standalone runtime for WebAssembly.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00924 Published 2022-07-21 Fixed in 0.38.2, 0.85.2 CWE-682

TI-2026-27340 CVE-2026-35186 · GHSA-f984-pcp8-v2p7

Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend

LOW 33

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 6.1 Network Low privileges No interaction EPSS 0.00222 Published 2026-04-09 Partial fix · 36.0.7, 42.0.2 +2 CWE-789

TI-2026-27167 CVE-2026-34943 · GHSA-m758-wjhj-p3jq

Wasmtime panics when lifting `flags` component value

LOW 31

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 5.6 Network High privileges User interaction EPSS 0.00336 Published 2026-04-09 Partial fix · 24.0.7, 36.0.7 +3 CWE-248

TI-2026-27165 CVE-2026-34941 · GHSA-hx6p-xpx3-jvvv

Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

LOW 31

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.0039 Published 2026-04-09 Partial fix · 24.0.7, 36.0.7 +3 CWE-125

TI-2026-21965 CVE-2026-27572 · GHSA-243v-98vx-264h

Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

LOW 31

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00519 Published 2026-02-24 Partial fix · 24.0.6, 36.0.6 +2 CWE-770

TI-2026-21639 CVE-2026-27204 · GHSA-852m-cvvp-9p4w

Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion

LOW 31

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00404 Published 2026-02-24 Partial fix · 24.0.6, 36.0.6 +2 CWE-400

TI-2022-13148 CVE-2022-31104 · GHSA-jqwc-c49r-4w2x

Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime

LOW 29

Wasmtime is a standalone runtime for WebAssembly.

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.01785 Published 2022-06-27 Fixed in 0.38.1, 0.85.1 CWE-682

TI-2021-16604 CVE-2021-39219 · GHSA-q879-9g95-56mx

Wrong type for `Linker`-define functions when used across two `Engine`s

LOW 28

Wasmtime is an open source runtime for WebAssembly & WASI.

CVSS 3.1MEDIUM 6.3 Local No auth User interaction EPSS 0.00361 Published 2021-09-17 Fixed in 0.30.0 CWE-843

TI-2021-16603 CVE-2021-39218 · GHSA-4873-36h9-wv49

Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime

LOW 28

Wasmtime is an open source runtime for WebAssembly & WASI.

CVSS 3.1MEDIUM 6.3 Local Low privileges No interaction EPSS 0.003 Published 2021-09-17 Fixed in 0.30.0 CWE-125

TI-2021-16601 CVE-2021-39216 · GHSA-v4cp-h94r-m7xf

Use after free passing `externref`s to Wasm in Wasmtime

LOW 28

Wasmtime is an open source runtime for WebAssembly & WASI.

CVSS 3.1MEDIUM 6.3 Local Low privileges No interaction EPSS 0.00307 Published 2021-09-17 Fixed in 0.30.0 CWE-416

TI-2026-27348 CVE-2026-35195 · GHSA-394w-hwhg-8vgm

Wasmtime has an out-of-bounds write or crash when transcoding component model strings

LOW 27

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 6.1 Network Low privileges No interaction EPSS 0.00224 Published 2026-04-09 Partial fix · 24.0.7, 36.0.7 +3 CWE-787

TI-2026-27170 CVE-2026-34946 · GHSA-q49f-xg75-m9xw

Wasmtime's host panics when Winch compiler executes `table.fill`

LOW 27

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00372 Published 2026-04-09 Partial fix · 36.0.7, 42.0.2 +2 CWE-670

Open these records in search →