wasmtime vulnerabilities
CVEs whose affected-version data names the wasmtime package (rust). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
75 CVEsRSS
RUSTSEC-2026-0316NoneDynamic record lifting can allocate beyond the hostcall fuel limit
Dynamic record lifting can allocate beyond the hostcall fuel limit
RUSTSEC-2026-0315Medium· 5.7`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
CVE-2026-115392High· 7.9Filesystem sandbox escape when paths or symlinks contain trailing slashes
Filesystem sandbox escape when paths or symlinks contain trailing slashes
CVE-2026-115391Medium· 5.8Guest controlled-size host heap allocation through WASIp3 streams
Guest controlled-size host heap allocation through WASIp3 streams
RUSTSEC-2026-0269NoneFilesystem sandbox escape when paths or symlinks contain trailing slashes
Filesystem sandbox escape when paths or symlinks contain trailing slashes
RUSTSEC-2026-0268NoneGuest controlled-size host heap allocation through WASIp3 streams
Guest controlled-size host heap allocation through WASIp3 streams
CVE-2026-115393Low· 3.8Stores can mix up type indices between engines
Stores can mix up type indices between engines
RUSTSEC-2026-0223NonePreemption and traps during bulk operations enable breaking internal VM state
Preemption and traps during bulk operations enable breaking internal VM state
RUSTSEC-2026-0222Low· 3.8Stores can mix up type indices between engines
Stores can mix up type indices between engines
CVE-2026-44216High· 7.5Wasmtime is a runtime for WebAssembly
Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus…
CVE-2026-34971NoneMiscompiled guest heap access enables sandbox escape on aarch64 Cranelift
Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift
CVE-2026-35186NoneImproperly masked return value from `table.grow` with Winch compiler backend
Improperly masked return value from `table.grow` with Winch compiler backend
CVE-2026-34987NoneWasmtime with Winch compiler backend may allow a sandbox-escaping memory access
Wasmtime with Winch compiler backend may allow a sandbox-escaping memory access
CVE-2026-34941NoneHeap OOB read in component model UTF-16 to latin1+utf16 string transcoding
Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding
CVE-2026-35195NoneOut-of-bounds write or crash when transcoding component model strings
Out-of-bounds write or crash when transcoding component model strings
CVE-2026-34983NoneUse-after-free bug after cloning `wasmtime::Linker`
Use-after-free bug after cloning `wasmtime::Linker`
CVE-2026-34942NonePanic when transcoding misaligned component model UTF-16 strings
Panic when transcoding misaligned component model UTF-16 strings
CVE-2026-34988NoneData leakage between pooling allocator instances
Data leakage between pooling allocator instances
CVE-2026-34946NoneHost panic when Winch compiler executes `table.fill`
Host panic when Winch compiler executes `table.fill`
CVE-2026-34944NoneWasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift x86-64
Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift x86-64
CVE-2026-34945NoneHost data leakage with 64-bit tables and Winch
Host data leakage with 64-bit tables and Winch
CVE-2026-34943NonePanic when lifting `flags` component value
Panic when lifting `flags` component value
CVE-2026-27572NonePanic adding excessive fields to a `wasi:http/types.fields` instance
Panic adding excessive fields to a `wasi:http/types.fields` instance
CVE-2026-27204NoneGuest-controlled resource exhaustion in WASI implementations
Guest-controlled resource exhaustion in WASI implementations
CVE-2026-27195NonePanic when dropping a `[Typed]Func::call_async` future
Panic when dropping a `[Typed]Func::call_async` future
CVE-2026-24116NoneWasmtime segfault or unused out-of-sandbox load with `f64.copysign` operator on x86-64
Wasmtime segfault or unused out-of-sandbox load with `f64.copysign` operator on x86-64
CVE-2025-64345Low· 1.8Unsound API access to a WebAssembly shared linear memory
Unsound API access to a WebAssembly shared linear memory
CVE-2025-62711Low· 3.1Wasmtime is a runtime for WebAssembly
Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which…
CVE-2025-53901Low· 3.3Host panic with `fd_renumber` WASIp1 function
Host panic with `fd_renumber` WASIp1 function
CVE-2024-51745NoneWasmtime doesn't fully sandbox all the Windows device filenames
Wasmtime doesn't fully sandbox all the Windows device filenames