Wasmtime vulnerable to data leakage between instances in the pooling allocator
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2 and 1.0.2. Other mitigations include disabling the pooling allocator and disabling the `memory-init-cow`.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| bytecodealliance | wasmtime | 2.0.0 to before 2.0.2; before 1.0.2 | 2.0.2, 1.0.2 | Patch available | CNA |
| — | wasmtime (crates.io) | 2.0.0 to before 2.0.2 | 2.0.2 | Patch available | GHSA-wh6w-3828-g9qf |
| — | wasmtime (crates.io) | before 1.0.2 | 1.0.2 | Patch available | GHSA-wh6w-3828-g9qf |
- wasmtime Vendorbytecodealliance Affected 2.0.0 to before 2.0.2; before 1.0.2 Fixed in 2.0.2, 1.0.2 Patch available CNA
- wasmtime (crates.io) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-wh6w-3828-g9qf
- wasmtime (crates.io) Vendor— Affected before 1.0.2 Fixed in 1.0.2 Patch available GHSA-wh6w-3828-g9qf
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:* | before 1.0.2; 2.0.0 to before 2.0.2 | Vulnerable | bytecodealliance |
- cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:* Versions before 1.0.2; 2.0.0 to before 2.0.2 Vulnerable ·bytecodealliance
Remediation
- Fix · CNA wasmtime (bytecodealliance) Fixed in 2.0.2, 1.0.2
- Fix · GHSA-wh6w-3828-g9qf wasmtime (crates.io) Fixed in 2.0.2 Advisory →
- Fix · GHSA-wh6w-3828-g9qf wasmtime (crates.io) Fixed in 1.0.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-39393
- 2026-10-03 Alias added: GHSA-wh6w-3828-g9qf
References
Advisory 2
Other 5
- https://github.com/bytecodealliance/wasmtime/commit/3535acbf3be032ef1ba0b469b8ab92538a8a18a6
- https://github.com/bytecodealliance/wasmtime
- https://groups.google.com/a/bytecodealliance.org/g/sec-announce/c/c1HBDDJwNPA
- https://rustsec.org/advisories/RUSTSEC-2022-0075.html
- https://rustsec.org/advisories/RUSTSEC-2022-0098.html
More bytecodealliance Wasmtime vulnerabilities
- TI-2026-21632 Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future CVSS 4.0MEDIUM 6.9
- TI-2023-11636 Guest-controlled out-of-bounds read/write on x86_64 in wasmtime CVSS 3.1CRITICAL 10.0
- TI-2022-08604 Use after free in Wasmtime CVSS 3.1CRITICAL 9.8
- TI-2022-18766 wasmtime_trap_code C API function has out of bounds write vulnerability CVSS 3.1CRITICAL 9.8
- TI-2026-27209 Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access CVSS 4.0CRITICAL 9.0
- TI-2026-27193 Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift CVSS 4.0CRITICAL 9.0
Sources
- CVE-2022-39393 · CVE Program
- CVE-2022-39393 · NVD
- FIRST EPSS
- GHSA-wh6w-3828-g9qf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences