Vulnerabilities

TI-2026-39592 CVE-2026-54786 · GHSA-3p27-qvp9-27qf

Wasmtime: Leak in WASIp1 `fd_renumber` implementation

LOW 12

Wasmtime is a runtime for WebAssembly.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00367 Published 2026-07-01 Partial fix · 24.0.10, 36.0.11 +2 CWE-400

TI-2026-34841 CVE-2026-47261 · GHSA-2r75-cxrj-cmph

Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

LOW 39

Wasmtime is a runtime for WebAssembly.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00357 Published 2026-06-15 Partial fix · 44.0.2, 36.0.10 +1 CWE-284

TI-2026-32195 CVE-2026-44216 · GHSA-p8xm-42r7-89xg

Wasmtime: Panic when allocating a table exceeding the size of the host's address space

LOW 26

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00319 Published 2026-05-14 Fixed in 36.0.8, 43.0.2 CWE-770

TI-2026-27348 CVE-2026-35195 · GHSA-394w-hwhg-8vgm

Wasmtime has an out-of-bounds write or crash when transcoding component model strings

LOW 27

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 6.1 Network Low privileges No interaction EPSS 0.00224 Published 2026-04-09 Partial fix · 24.0.7, 36.0.7 +3 CWE-787

TI-2026-27340 CVE-2026-35186 · GHSA-f984-pcp8-v2p7

Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend

LOW 33

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 6.1 Network Low privileges No interaction EPSS 0.00222 Published 2026-04-09 Partial fix · 36.0.7, 42.0.2 +2 CWE-789

TI-2026-27210 CVE-2026-34988 · GHSA-6wgr-89rj-399p

Wasmtime leaks data between pooling allocator instances

LOW 12

Wasmtime is a runtime for WebAssembly.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00297 Published 2026-04-09 Partial fix · 36.0.7, 42.0.2 +2 CWE-119

TI-2026-27209 CVE-2026-34987 · GHSA-xx5w-cvp6-jv83

Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access

MEDIUM 41

Wasmtime is a runtime for WebAssembly.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.00283 Published 2026-04-09 Fixed in 36.0.7, 42.0.2 +2 CWE-125

TI-2026-27205 CVE-2026-34983 · GHSA-hfr4-7c6c-48w2

Wasmtime has a use-after-free bug after cloning `wasmtime::Linker`

MEDIUM 40

Wasmtime is a runtime for WebAssembly.

CVSS 4.0LOW 1.0 Physical High privileges User interaction EPSS 0.00121 Published 2026-04-09 Partial fix · 43.0.1 CWE-416

TI-2026-27193 CVE-2026-34971 · GHSA-jhxm-h53p-jm7w

Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

MEDIUM 41

Wasmtime is a runtime for WebAssembly.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.00324 Published 2026-04-09 Partial fix · 36.0.7, 42.0.2 +2 CWE-125

TI-2026-27170 CVE-2026-34946 · GHSA-q49f-xg75-m9xw

Wasmtime's host panics when Winch compiler executes `table.fill`

LOW 27

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00372 Published 2026-04-09 Partial fix · 36.0.7, 42.0.2 +2 CWE-670

TI-2026-27169 CVE-2026-34945 · GHSA-m9w2-8782-2946

Wasmtime leaks host data with 64-bit tables and Winch

LOW 12

Wasmtime is a runtime for WebAssembly.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00336 Published 2026-04-09 Partial fix · 36.0.7, 42.0.2 +2 CWE-681

TI-2026-27168 CVE-2026-34944 · GHSA-qqfj-4vcm-26hv

Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64

LOW 19

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 4.1 Local Low privileges User interaction EPSS 0.00236 Published 2026-04-09 Partial fix · 24.0.7, 36.0.7 +3 CWE-248

TI-2026-27167 CVE-2026-34943 · GHSA-m758-wjhj-p3jq

Wasmtime panics when lifting `flags` component value

LOW 31

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 5.6 Network High privileges User interaction EPSS 0.00336 Published 2026-04-09 Partial fix · 24.0.7, 36.0.7 +3 CWE-248

TI-2026-27166 CVE-2026-34942 · GHSA-jxhv-7h78-9775

Wasmtime panics when transcoding misaligned utf-16 strings

LOW 27

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00368 Published 2026-04-09 Partial fix · 24.0.7, 36.0.7 +3 CWE-129

TI-2026-27165 CVE-2026-34941 · GHSA-hx6p-xpx3-jvvv

Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

LOW 31

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.0039 Published 2026-04-09 Partial fix · 24.0.7, 36.0.7 +3 CWE-125

TI-2026-21965 CVE-2026-27572 · GHSA-243v-98vx-264h

Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

LOW 31

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00519 Published 2026-02-24 Partial fix · 24.0.6, 36.0.6 +2 CWE-770

TI-2026-21639 CVE-2026-27204 · GHSA-852m-cvvp-9p4w

Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion

LOW 31

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00404 Published 2026-02-24 Partial fix · 24.0.6, 36.0.6 +2 CWE-400

TI-2026-21632 CVE-2026-27195 · GHSA-xjhv-v822-pf94

Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

MEDIUM 64

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00412 Published 2026-02-24 Partial fix · 40.0.4, 41.0.4 CWE-755

TI-2026-19436 CVE-2026-24116 · GHSA-vc8c-j3xm-xj73

Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64

LOW 19

Wasmtime is a runtime for WebAssembly.

CVSS 4.0MEDIUM 4.1 Local Low privileges User interaction EPSS 0.00246 Published 2026-01-27 Fixed in 36.0.5, 40.0.3 +1 CWE-125

TI-2025-38901 CVE-2025-62711 · GHSA-4h67-722j-5pmc

Wasmtime vulnerable to segfault when using component resources

LOW 11

Wasmtime is a runtime for WebAssembly.

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.0041 Published 2025-10-24 Partial fix · 38.0.3 CWE-755

TI-2025-38103 CVE-2025-61670 · GHSA-vvp9-h8p2-xwfc

Wasmtime has memory leak in C API with `externref` and `anyref` types

LOW 6

Wasmtime is a runtime for WebAssembly.

CVSS 4.0LOW 1.0 Adjacent network Low privileges User interaction EPSS 0.00195 Published 2025-10-07 Fixed in 37.0.2 CWE-772

TI-2025-33774 CVE-2025-53901 · GHSA-fm79-3f68-h2fc

Wasmtime has host panic with `fd_renumber` WASIp1 function

LOW 17

Wasmtime is a runtime for WebAssembly.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00381 Published 2025-07-18 Fixed in 24.0.4, 33.0.2 +1 CWE-672

TI-2024-34650 CVE-2024-51745 · GHSA-c2f5-jxjv-2hh8

Wasmtime doesn't fully sandbox all the Windows device filenames

LOW 14

Wasmtime is a fast and secure runtime for WebAssembly.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00836 Published 2024-11-05 Fixed in 24.0.2, 25.0.3 +1 CWE-184

TI-2024-32080 CVE-2024-47813 · GHSA-7qmx-3fpx-r45m

Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations

LOW 13

Wasmtime is an open source runtime for WebAssembly.

CVSS 3.1LOW 2.9 Local High privileges User interaction EPSS 0.00153 Published 2024-10-09 Fixed in 21.0.2, 22.0.1 +3 CWE-367

TI-2024-32038 CVE-2024-47763 · GHSA-q8hx-mm92-4wvg

Wasmtime runtime crash when combining tail calls with trapping imports

LOW 24

Wasmtime is an open source runtime for WebAssembly.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00245 Published 2024-10-09 Fixed in 21.0.2, 22.0.1 +3 CWE-670

Vulnerabilities

Filters