TI-2022-07688 Aliases CVE-2022-23636 GHSA-88xq-w8cq-xfg7

Invalid drop of partially-initialized instances in wasmtime

LOW 37CWE-824Published 2022-02-16 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-824 and the CVSS impact.

Summary

Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` global will result in an invalid drop of a `VMExternRef` via an uninitialized pointer. A number of conditions listed in the GitHub Security Advisory must be true in order for an instance to be vulnerable to this issue. Maintainers believe that the effective impact of this bug is relatively small because the usage of `externref` is still uncommon and without a resource limiter configured on the `Store`, which is not the default configuration, it is only possible to trigger the bug from an error returned by `mprotect` or `VirtualAlloc`. Note that on Linux with the `uffd` feature enabled, it is only possible to trigger the bug from a resource limiter as the call to `mprotect` is skipped. The bug has been fixed in 0.34.1 and 0.33.1 and users are encouraged to upgrade as soon as possible. If it is not possible to upgrade to version 0.34.1 or 0.33.1 of the `wasmtime` crate, it is recommend that support for the reference types proposal be disabled by passing `false` to `Config::wasm_reference_types`. Doing so will prevent modules that use `externref` from being loaded entirely.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00772 55th percentileScored 2026-11-07

Fix Fixed wasmtime (bytecodealliance): 0.33.0wasmtime (crates.io): 0.34.1, 0.33.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
bytecodealliance	wasmtime	before 0.33.0; = 0.34.0	0.33.0	Patch available	CNA
—	wasmtime (crates.io)	0.34.0 to before 0.34.1	0.34.1	Patch available	GHSA-88xq-w8cq-xfg7
—	wasmtime (crates.io)	before 0.33.1	0.33.1	Patch available	GHSA-88xq-w8cq-xfg7

wasmtime Vendorbytecodealliance Affected before 0.33.0; = 0.34.0 Fixed in 0.33.0 Patch available CNA
wasmtime (crates.io) Vendor— Affected 0.34.0 to before 0.34.1 Fixed in 0.34.1 Patch available GHSA-88xq-w8cq-xfg7
wasmtime (crates.io) Vendor— Affected before 0.33.1 Fixed in 0.33.1 Patch available GHSA-88xq-w8cq-xfg7

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:bytecodealliance:wasmtime::::::rust::*	before 0.33.1	Vulnerable	bytecodealliance
cpe:2.3:a:bytecodealliance:wasmtime:0.34.0:::::rust::	0.34.0	Vulnerable	bytecodealliance

cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:* Versions before 0.33.1 Vulnerable ·bytecodealliance
cpe:2.3:a:bytecodealliance:wasmtime:0.34.0:*:*:*:*:rust:*:* Versions 0.34.0 Vulnerable ·bytecodealliance

Remediation

Fix · CNA wasmtime (bytecodealliance) Fixed in 0.33.0
Fix · GHSA-88xq-w8cq-xfg7 wasmtime (crates.io) Fixed in 0.34.1 Advisory →
Fix · GHSA-88xq-w8cq-xfg7 wasmtime (crates.io) Fixed in 0.33.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-23636
2026-10-03 Alias added: GHSA-88xq-w8cq-xfg7

References

Patch 1

https://github.com/bytecodealliance/wasmtime/commit/886ecc562040bef61faf19438c22285c2d62403a

Advisory 2

Other 2

TI-2026-21632 Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future CVSS 4.0MEDIUM 6.9
TI-2023-11636 Guest-controlled out-of-bounds read/write on x86_64 in wasmtime CVSS 3.1CRITICAL 10.0
TI-2022-18765 Wasmtime vulnerable to data leakage between instances in the pooling allocator CVSS 3.1HIGH 8.6
TI-2022-08604 Use after free in Wasmtime CVSS 3.1CRITICAL 9.8
TI-2022-18766 wasmtime_trap_code C API function has out of bounds write vulnerability CVSS 3.1CRITICAL 9.8
TI-2026-27209 Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access CVSS 4.0CRITICAL 9.0

See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences