wasmtime vulnerabilities
CVEs whose affected-version data names the wasmtime package (rust). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
90 CVEsRSS
CVE-2026-34983NoneUse-after-free bug after cloning `wasmtime::Linker`
Use-after-free bug after cloning `wasmtime::Linker`
CVE-2026-34942NonePanic when transcoding misaligned component model UTF-16 strings
Panic when transcoding misaligned component model UTF-16 strings
CVE-2026-34988NoneData leakage between pooling allocator instances
Data leakage between pooling allocator instances
CVE-2026-34946NoneHost panic when Winch compiler executes `table.fill`
Host panic when Winch compiler executes `table.fill`
CVE-2026-34944NoneWasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift x86-64
Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift x86-64
CVE-2026-34945NoneHost data leakage with 64-bit tables and Winch
Host data leakage with 64-bit tables and Winch
CVE-2026-34943NonePanic when lifting `flags` component value
Panic when lifting `flags` component value
CVE-2026-27572NonePanic adding excessive fields to a `wasi:http/types.fields` instance
Panic adding excessive fields to a `wasi:http/types.fields` instance
CVE-2026-27204NoneGuest-controlled resource exhaustion in WASI implementations
Guest-controlled resource exhaustion in WASI implementations
CVE-2026-27195NonePanic when dropping a `[Typed]Func::call_async` future
Panic when dropping a `[Typed]Func::call_async` future
CVE-2026-24116NoneWasmtime segfault or unused out-of-sandbox load with `f64.copysign` operator on x86-64
Wasmtime segfault or unused out-of-sandbox load with `f64.copysign` operator on x86-64
CVE-2025-64345Low· 1.8Unsound API access to a WebAssembly shared linear memory
Unsound API access to a WebAssembly shared linear memory
CVE-2025-62711Low· 3.1Wasmtime is a runtime for WebAssembly
Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which…
CVE-2025-53901Low· 3.3Host panic with `fd_renumber` WASIp1 function
Host panic with `fd_renumber` WASIp1 function
CVE-2024-51745NoneWasmtime doesn't fully sandbox all the Windows device filenames
Wasmtime doesn't fully sandbox all the Windows device filenames
CVE-2024-47813Low· 2.9Race condition could lead to WebAssembly control-flow integrity and type safety violations
Race condition could lead to WebAssembly control-flow integrity and type safety violations
CVE-2024-47763Medium· 5.5Runtime crash when combining tail calls with stack traces
Runtime crash when combining tail calls with stack traces
CVE-2024-30266Low· 3.3Panic when using a dropped extenref-typed element segment
Panic when using a dropped extenref-typed element segment
CVE-2023-41880Low· 2.2Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86\_64
Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86\_64
CVE-2023-30624Low· 3.9Undefined Behavior in Rust runtime functions
Undefined Behavior in Rust runtime functions
CVE-2023-27477Low· 3.1Miscompilation of `i8x16.select` with the same inputs on x86\_64
Miscompilation of `i8x16.select` with the same inputs on x86\_64
CVE-2023-26489Critical· 9.9Guest-controlled out-of-bounds read/write on x86\_64
Guest-controlled out-of-bounds read/write on x86\_64
CVE-2022-39393High· 8.6Bug in pooling instance allocator
Bug in pooling instance allocator
CVE-2022-39394Low· 3.8Out of bounds write in `wasmtime_trap_code` C API function
Out of bounds write in `wasmtime_trap_code` C API function
CVE-2022-39392Medium· 5.9Out of bounds read/write with zero-memory-pages configuration
Out of bounds read/write with zero-memory-pages configuration
CVE-2022-31146NoneUse After Free with `externref`s in Wasmtime
Use After Free with `externref`s in Wasmtime
CVE-2022-23636NonePoCMiscompilation of constant values in division on AArch64
Miscompilation of constant values in division on AArch64
CVE-2022-31104NoneMiscompilation of `i8x16.swizzle` and `select` with v128 inputs
Miscompilation of `i8x16.swizzle` and `select` with v128 inputs
CVE-2022-24791NoneUse after free with `externref`s and epoch interruption in Wasmtime
Use after free with `externref`s and epoch interruption in Wasmtime
CVE-2021-39216Medium· 6.3Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime
Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime