CVE-2025-62711Low· 3.1▾ SunlitWasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 17.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched to fix this issue. There are no workarounds.
wasmtime >= 38.0.0, < 38.0.3Upgrade past the affected range:
wasmtime 38.0.3Affected packages:
wasmtime >= 38.0.0, < 38.0.3Patched in:
wasmtime 38.0.3Connected by shared product, vendor, weakness, or advisory.
RUSTSEC-2026-0424NoneUnchecked memory usage in transferring borrowed resources between components
RUSTSEC-2026-0423NoneCross-engine type confusion with host-created struct-types-with-supertypes
RUSTSEC-2026-0422Low· 1.8Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check
CVE-2026-119133NoneException tags can cause host data structures to be unaligned
CVE-2026-119134Medium· 6.2Component-model handle tables are capped only per instance and charged to no limit
CVE-2026-119136NoneWasmtime may not properly enforce async-entrypoint requirement