Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-787 and the CVSS impact.
Summary
Wasmi is an efficient and lightweight WebAssembly interpreter with a focus on constrained and embedded systems. In the WASMI Interpreter, an Out-of-bounds Buffer Write will arise if the host calls or resumes a Wasm function with more parameters than the default limit (128), as it will surpass the stack value. This doesn’t affect calls from Wasm to Wasm, only from host to Wasm. This vulnerability was patched in version 0.31.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wasmi-labs | wasmi | 0.15.0 – 0.31.0 | — | No fix listed | CNA |
| — | wasmi (crates.io) | 0.15.0 to before 0.31.1 | 0.31.1 | Patch available | GHSA-75jp-vq8x-h4cq |
- wasmi Vendorwasmi-labs Affected 0.15.0 – 0.31.0 Fixed in — No fix listed CNA
- wasmi (crates.io) Vendor— Affected 0.15.0 to before 0.31.1 Fixed in 0.31.1 Patch available GHSA-75jp-vq8x-h4cq
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wasmi-labs:wasmi:*:*:*:*:*:rust:*:* | 0.15.0 to before 0.31.1 | Vulnerable | wasmi-labs |
- cpe:2.3:a:wasmi-labs:wasmi:*:*:*:*:*:rust:*:* Versions 0.15.0 to before 0.31.1 Vulnerable ·wasmi-labs
Remediation
- Fix · GHSA-75jp-vq8x-h4cq wasmi (crates.io) Fixed in 0.31.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-28123
- 2026-10-03 Alias added: GHSA-75jp-vq8x-h4cq
References
Advisory 2
More wasmi-labs Wasmi vulnerabilities
- TI-2025-41021 Wasmi's Linear Memory has a Critical Use After Free Vulnerability CVSS 3.1HIGH 8.4
Sources
- CVE-2024-28123 · CVE Program
- CVE-2024-28123 · NVD
- FIRST EPSS
- GHSA-75jp-vq8x-h4cq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences