Read the docs
TI-2023-22273 Aliases CVE-2023-41880GHSA-gw5p-q8mj-p7gh

Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64

Priority LOW 25CWE-193Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a miscompilation of the WebAssembly `i64x2.shr_s` instruction on x86_64 platforms when the shift amount is a constant value that is larger than 32. Only x86_64 is affected so all other targets are not affected by this. The miscompilation results in the instruction producing an incorrect result, namely the low 32-bits of the second lane of the vector are derived from the low 32-bits of the second lane of the input vector instead of the high 32-bits. The primary impact of this issue is that any WebAssembly program using the `i64x2.shr_s` with a constant shift amount larger than 32 may produce an incorrect result. This issue is not an escape from the WebAssembly sandbox. Execution of WebAssembly guest programs will still behave correctly with respect to memory sandboxing and isolation from the host. Wasmtime considers non-spec-compliant behavior as a security issue nonetheless. This issue was discovered through fuzzing of Wasmtime's code generator Cranelift. Wasmtime versions 10.0.2, 11.0.2, and 12.0.2 are all patched to no longer have this miscompilation. This issue only affects x86_64 hosts and the only workaround is to either scan for this pattern in wasm modules which is nontrivial or to disable the SIMD proposal for WebAssembly. Users prior to 10.0.0 are unaffected by this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00672 52nd percentileScored 2026-11-07
Fix Fixed wasmtime (bytecodealliance): 10.0.2, 11.0.2, 12.0.2wasmtime (crates.io): 10.0.2, 11.0.2, 12.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bytecodealliancewasmtime10.0.0 to before 10.0.2; 11.0.0 to before 11.0.2; 12.0.0 to before 12.0.210.0.2, 11.0.2, 12.0.2Patch availableCNA
—wasmtime (crates.io)10.0.0 to before 10.0.210.0.2Patch availableGHSA-gw5p-q8mj-p7gh
—wasmtime (crates.io)11.0.0 to before 11.0.211.0.2Patch availableGHSA-gw5p-q8mj-p7gh
—wasmtime (crates.io)12.0.0 to before 12.0.212.0.2Patch availableGHSA-gw5p-q8mj-p7gh
  • wasmtime Vendorbytecodealliance Affected 10.0.0 to before 10.0.2; 11.0.0 to before 11.0.2; 12.0.0 to before 12.0.2 Fixed in 10.0.2, 11.0.2, 12.0.2 Patch available CNA
  • wasmtime (crates.io) Vendor— Affected 10.0.0 to before 10.0.2 Fixed in 10.0.2 Patch available GHSA-gw5p-q8mj-p7gh
  • wasmtime (crates.io) Vendor— Affected 11.0.0 to before 11.0.2 Fixed in 11.0.2 Patch available GHSA-gw5p-q8mj-p7gh
  • wasmtime (crates.io) Vendor— Affected 12.0.0 to before 12.0.2 Fixed in 12.0.2 Patch available GHSA-gw5p-q8mj-p7gh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:x64:*10.0.0 to before 10.0.2; 11.0.0 to before 11.0.2; 12.0.0 to before 12.0.2Vulnerablebytecodealliance
  • cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:x64:* Versions 10.0.0 to before 10.0.2; 11.0.0 to before 11.0.2; 12.0.0 to before 12.0.2 Vulnerable ·bytecodealliance

Remediation

  • Fix · CNA wasmtime (bytecodealliance) Fixed in 10.0.2, 11.0.2, 12.0.2
  • Fix · GHSA-gw5p-q8mj-p7gh wasmtime (crates.io) Fixed in 10.0.2 Advisory →
  • Fix · GHSA-gw5p-q8mj-p7gh wasmtime (crates.io) Fixed in 11.0.2 Advisory →
  • Fix · GHSA-gw5p-q8mj-p7gh wasmtime (crates.io) Fixed in 12.0.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-41880
  2. 2026-10-03 Alias added: GHSA-gw5p-q8mj-p7gh

References

Patch 2

Advisory 3

Other 3

  • TI-2026-21632 Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future CVSS 4.0MEDIUM 6.9
  • TI-2023-11636 Guest-controlled out-of-bounds read/write on x86_64 in wasmtime CVSS 3.1CRITICAL 10.0
  • TI-2022-18765 Wasmtime vulnerable to data leakage between instances in the pooling allocator CVSS 3.1HIGH 8.6
  • TI-2022-08604 Use after free in Wasmtime CVSS 3.1CRITICAL 9.8
  • TI-2022-18766 wasmtime_trap_code C API function has out of bounds write vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-27209 Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access CVSS 4.0CRITICAL 9.0
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences