{"id":"CVE-2022-39393","aliases":["RUSTSEC-2022-0075","GHSA-wh6w-3828-g9qf","RUSTSEC-2022-0098"],"title":"Bug in pooling instance allocator","summary":"Bug in pooling instance allocator","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","vendor":"wasmtime","product":"wasmtime","ecosystem":"rust","affected":["wasmtime >= 2.0.0, < 2.0.2"],"patched":["wasmtime 2.0.2"],"published":"2022-11-10","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:05.117534654Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2022-0075","references":[{"url":"https://crates.io/crates/wasmtime"},{"url":"https://rustsec.org/advisories/RUSTSEC-2022-0075.html"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/2614f2e9d2d36805ead8a8da0fa0c6e0d9e428a0"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/2614f2e9d2d36805ead8a8da0fa0c6e0d9e428a0"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/3535acbf3be032ef1ba0b469b8ab92538a8a18a6"},{"url":"https://rustsec.org/advisories/RUSTSEC-2022-0098.html"}],"tags":["osv","rust"],"cvssSource":"osv","epss":0.00754,"epssPercentile":0.54891,"ingestedAt":"2026-10-13T11:45:30.157Z","slug":"CVE-2022-39393","body":"## Overview\n\nbug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance.\n\nMitigations are described [here](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wh6w-3828-g9qf).\n\n## Affected packages\n\n- `wasmtime >= 2.0.0, < 2.0.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `wasmtime 2.0.2`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}