---
id: CVE-2021-32629
aliases:
  - RUSTSEC-2021-0067
  - GHSA-hpqh-2wqx-7qp5
  - PYSEC-2021-87
title: Memory access due to code generation flaw in Cranelift module
summary: Memory access due to code generation flaw in Cranelift module
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
vendor: cranelift-codegen
product: cranelift-codegen
ecosystem: rust
affected:
  - 'cranelift-codegen >= 0.0.0-0, < 0.73.1'
patched:
  - cranelift-codegen 0.73.1
published: '2021-05-21'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:06.113401230Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2021-0067'
references:
  - url: 'https://crates.io/crates/cranelift-codegen'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2021-0067.html'
  - url: >-
      https://github.com/bytecodealliance/wasmtime/commit/95559c01aaa7c061088a433040f31e8291fb09d0
  - url: >-
      https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hpqh-2wqx-7qp5
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-32629'
  - url: >-
      https://github.com/RustSec/advisory-db/blob/main/crates/cranelift-codegen/RUSTSEC-2021-0067.md
  - url: 'https://github.com/bytecodealliance/wasmtime/tree/main/cranelift'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/wasmtime/PYSEC-2021-87.yaml
  - url: >-
      https://www.fastly.com/security-advisories/memory-access-due-to-code-generation-flaw-in-cranelift-module
tags:
  - osv
  - rust
epss: 0.00455
epssPercentile: 0.39287
ingestedAt: '2026-07-08T18:25:50.297Z'
---

## Overview

There is a bug in 0.73.0 of the Cranelift x64 backend that can create a
scenario that could result in a potential sandbox escape in a WebAssembly
module. Users of versions 0.73.0 of Cranelift should upgrade to either 0.73.1
or 0.74 to remediate this vulnerability. Users of Cranelift prior to 0.73.0
should update to 0.73.1 or 0.74 if they were not using the old default backend.

More details can be found in the GitHub Security Advisory at:

<https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hpqh-2wqx-7qp5>

## Affected packages

- `cranelift-codegen >= 0.0.0-0, < 0.73.1`

## Remediation

Upgrade to a patched release:

- `cranelift-codegen 0.73.1`