Skip to contentBytecodealliance Wasmtime vulnerabilities
- bytecodealliance wasmtimeWasmtime panics when lifting `flags` component valueCVE-2026-34943Fix available5.6 Medium
- bytecodealliance wasmtimeWasmtime panics when transcoding misaligned utf-16 stringsCVE-2026-34942Fix available5.9 Medium
- bytecodealliance wasmtimeWasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcodingCVE-2026-34941Fix available6.9 Medium
- bytecodealliance wasmtimeWasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instanceCVE-2026-27572Fix available6.9 Medium
- bytecodealliance wasmtimeWasmtime WASI implementations are vulnerable to guest-controlled resource exhaustionCVE-2026-27204Fix available6.9 Medium
- bytecodealliance wasmtimeWasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` futureCVE-2026-27195Fix available6.9 Medium
- bytecodealliance wasmtimeWasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64CVE-2026-24116Fix available4.1 Medium
- bytecodealliance wasmtimeWasmtime provides unsound API access to a WebAssembly shared linear memoryCVE-2025-64345Fix available1.8 Low
- bytecodealliance wasmtimeWasmtime has memory leak in C API with `externref` and `anyref` typesCVE-2025-61670Fix available1.0 Low
- bytecodealliance wasmtimeWasmtime vulnerable to segfault when using component resourcesCVE-2025-62711Fix available2.1 Low
- bytecodealliance wasmtimeWasmtime has host panic with `fd_renumber` WASIp1 functionCVE-2025-53901Fix available3.5 Low
- bytecodealliance wasmtimeWasmtime doesn't fully sandbox all the Windows device filenamesCVE-2024-51745Fix available2.3 Low
- bytecodealliance wasmtimeWasmtime race condition could lead to WebAssembly control-flow integrity and type safety violationsCVE-2024-47813Fix available2.9 Low
- bytecodealliance wasmtimeWasmtime runtime crash when combining tail calls with trapping importsCVE-2024-47763Fix available5.5 Medium
- bytecodealliance wasmtimeWasmtime vulnerable to panic when using a dropped extenref-typed element segmentCVE-2024-30266Fix available3.3 Low
- bytecodealliance wasmtimeMiscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64CVE-2023-41880Fix available2.2 Low
- bytecodealliance wasmtimeWasmtime has Undefined Behavior in Rust runtime functionsCVE-2023-30624Fix available3.9 Low
- bytecodealliance wasmtime, cranelift-codegen +1 morewasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64CVE-2023-27477Fix available3.1 Low
- bytecodealliance wasmtime, cranelift-codegen +1 moreGuest-controlled out-of-bounds read/write on x86_64 in wasmtimeCVE-2023-26489Fix available10.0 Critical
- bytecodealliance wasmtimewasmtime_trap_code C API function has out of bounds write vulnerabilityCVE-2022-39394Fix available3.8 Low
- bytecodealliance wasmtimeWasmtime vulnerable to data leakage between instances in the pooling allocatorCVE-2022-39393Fix available8.6 High
- bytecodealliance wasmtimeWasmtime vulnerable to out of bounds read/write with zero-memory-pages configurationCVE-2022-39392Fix available5.9 Medium
- bytecodealliance wasmtime, cranelift-codegen +1 moreUse After Free in WasmtimeCVE-2022-31146Fix available6.4 Medium
- bytecodealliance cranelift-codegen, wasmtime +1 moreMiscompilation of `i8x16.swizzle` and `select` with v128 inputs in WasmtimeCVE-2022-31104Fix available4.8 Medium
- bytecodealliance wasmtimeUse after free in WasmtimeCVE-2022-24791Fix available8.1 High
- bytecodealliance cranelift-codegen, wasmtime +1 moreCranelift vulnerable to miscompilation of constant values in division on AArch64CVE-2022-31169Fix available5.9 Medium
- bytecodealliance wasmtimeInvalid drop of partially-initialized instances in wasmtimeCVE-2022-23636Public exploitFix available5.1 Medium
- bytecodealliance wasmtime, fedoraproject fedora +1 moreWrong type for `Linker`-define functions when used across two `Engine`sCVE-2021-39219Fix available6.3 Medium
- bytecodealliance wasmtime, fedoraproject fedora +1 moreOut-of-bounds read/write and invalid free with `externref`s and GC safepoints in WasmtimeCVE-2021-39218Fix available6.3 Medium
- bytecodealliance wasmtime, fedoraproject fedora +1 moreUse after free passing `externref`s to Wasm in WasmtimeCVE-2021-39216Fix available6.3 Medium
- bytecodealliance wasmtime, cranelift-codegen +1 moreMemory access due to code generation flaw in Cranelift moduleCVE-2021-32629Fix available7.2 High