{"id":"CVE-2022-39394","aliases":["EUVD-2024-0651","GHSA-h84q-m8rr-3v9q","RUSTSEC-2022-0097","UBUNTU-CVE-2022-39394"],"status":"published","title":"wasmtime_trap_code C API function has out of bounds write vulnerability","description":"Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.","severity":{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00423,"percentile":0.36907,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2022-11-07T12:00:00Z","modified":"2026-10-28T02:30:30Z","fixes":[{"ecosystem":"crates.io","package":"wasmtime","fixed_in":["2.0.2","1.0.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.2"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"1.0.2"},{"introduced":"2.0.0"},{"fixed":"2.0.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.3.1-0ubuntu3","52.3.1-7fakesync1","52.8.1-0ubuntu0.18.04.1","52.9.1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs38","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["38.8.0~repack1-0ubuntu1","38.8.0~repack1-0ubuntu3","38.8.0~repack1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs68","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["68.5.0-1~fakesync","68.5.0-2~fakesync","68.6.0-1","68.6.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.9.1-1build1","52.9.1-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["78.13.0-1","78.15.0-2","78.15.0-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["91.5.1-0ubuntu1","91.6.0-1","91.6.0-2","91.7.0-2","91.10.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1","1:128.12.0+build1-0ubuntu0.22.04.1","1:140.7.1+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:115.3.1+build1-0ubuntu1","1:115.4.1+build1-0ubuntu1","1:115.4.3+build1-0ubuntu1","1:115.5.0+build1-0ubuntu1","1:115.5.1+build1-0ubuntu1","1:115.5.2+build2-0ubuntu1","1:115.6.0+build1-0ubuntu1","1:115.6.0+build2-0ubuntu1","1:115.6.1+build1-0ubuntu1","1:115.8.0+build1-0ubuntu1","1:115.8.1+build1+snap2","1:115.8.1+build1+snap3","2:1snap1-0ubuntu1","2:1snap1-0ubuntu3"]}],"products":[{"vendor":"bytecodealliance","product":"wasmtime"}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9q","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/bytecodealliance/wasmtime/commit/087d9d7becf7422b3f872a3bcd5d97bb7ce7ff36","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39394","tags":["advisory"]},{"url":"https://github.com/bytecodealliance/wasmtime/commit/5b6d5e78de106503b3b9add218bb3d2b1d63c493","tags":["web"]},{"url":"https://groups.google.com/a/bytecodealliance.org/g/sec-announce/c/c1HBDDJwNPA","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2022-0097.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-h84q-m8rr-3v9q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39394.json","tags":["advisory"]},{"url":"https://github.com/bytecodealliance/wasmtime","tags":["package"]},{"url":"https://crates.io/crates/wasmtime","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-39394","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39394","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-39394","title":"wasmtime_trap_code C API function has out of bounds write vulnerability","description":"Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.","status":"published","published":"2022-11-10T00:00:00Z","modified":"2025-04-23T16:39:05.163Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:34:39.559326Z"}],"euvd":[{"id":"EUVD-2024-0651","description":"Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.","status":"published","published":"2022-11-10T00:00:00Z","modified":"2025-04-23T16:39:05Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T20:52:12.313971Z"}],"ghsa":[{"id":"GHSA-h84q-m8rr-3v9q","title":"wasmtime_trap_code C API function has out of bounds write vulnerability","description":"### Impact\n\nThere is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller.\n\n### Patches\n\nThis bug has been patched and users should upgrade to Wasmtime 2.0.2.\n\n### Workarounds\n\nThis can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.\n\n### References\n\n* [Definition of `wasmtime_trap_code`](https://docs.wasmtime.dev/c-api/trap_8h.html#a6580f4f209d3eaebb6e8b9a901a30b7a)\n* [Mailing list announcement](https://groups.google.com/a/bytecodealliance.org/g/sec-announce/c/c1HBDDJwNPA)\n* [Patch to fix for `main` branch](https://github.com/bytecodealliance/wasmtime/commit/5b6d5e78de106503b3b9add218bb3d2b1d63c493)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Reach out to us on [the Bytecode Alliance Zulip chat](https://bytecodealliance.zulipchat.com/#narrow/stream/217126-wasmtime)\n* Open an issue in [the bytecodealliance/wasmtime repository](https://github.com/bytecodealliance/wasmtime/)","status":"published","published":"2024-02-01T00:15:47Z","modified":"2025-05-02T12:51:46Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:38:42.263728Z"}],"nvd":[{"id":"CVE-2022-39394","description":"Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.","status":"published","published":"2022-11-10T20:15:11.85Z","modified":"2026-06-17T04:58:16.46Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:31.914793Z"}],"osv":[{"id":"CVE-2022-39394","title":"wasmtime_trap_code C API function has out of bounds write vulnerability","description":"Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.","status":"published","published":"2022-11-10T00:00:00Z","modified":"2026-10-28T02:30:30.058970501Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"GHSA-h84q-m8rr-3v9q","title":"wasmtime_trap_code C API function has out of bounds write vulnerability","description":"### Impact\n\nThere is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller.\n\n### Patches\n\nThis bug has been patched and users should upgrade to Wasmtime 2.0.2.\n\n### Workarounds\n\nThis can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.\n\n### References\n\n* [Definition of `wasmtime_trap_code`](https://docs.wasmtime.dev/c-api/trap_8h.html#a6580f4f209d3eaebb6e8b9a901a30b7a)\n* [Mailing list announcement](https://groups.google.com/a/bytecodealliance.org/g/sec-announce/c/c1HBDDJwNPA)\n* [Patch to fix for `main` branch](https://github.com/bytecodealliance/wasmtime/commit/5b6d5e78de106503b3b9add218bb3d2b1d63c493)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Reach out to us on [the Bytecode Alliance Zulip chat](https://bytecodealliance.zulipchat.com/#narrow/stream/217126-wasmtime)\n* Open an issue in [the bytecodealliance/wasmtime repository](https://github.com/bytecodealliance/wasmtime/)","status":"published","published":"2024-02-01T00:15:47Z","modified":"2025-05-02T12:51:45Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"RUSTSEC-2022-0097","title":"Out of bounds write in `wasmtime_trap_code` C API function","description":"This is an entry in the RustSec database for the Wasmtime security advisory\nlocated at\nhttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9q.\nFor more information see the GitHub-hosted security advisory.","status":"published","published":"2022-11-07T12:00:00Z","modified":"2026-10-12T18:00:06.11247283Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:39.971022Z"},{"id":"UBUNTU-CVE-2022-39394","description":"Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.","status":"published","published":"2022-11-10T20:15:00Z","modified":"2026-04-22T13:27:35.574773Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T16:53:55.502114Z"}]}}