wasmtime has 68 CVEs on record between 2021 and 2026. Disclosure cadence is accelerating: 34 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 23. The median CVSS is 5.7 (medium), with 5 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.7
- Publish → KEV
- —
- Last 90 days
- 34 prev 0
Weakness classes
Products
- wasmtime 68
Worst active — by depth score
CVE-2026-115893Critical· 9.9Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction67CVE-2026-115384Critical· 9.9Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow55CVE-2023-26489Critical· 9.9Guest-controlled out-of-bounds read/write on x86\_6455RUSTSEC-2026-0380Critical· 9.9Bit-packing in Cranelift compiler causes silent overflow and miscompilation54RUSTSEC-2026-0379Critical· 9.9Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction54
wasmtime vulnerabilities
CVEs affecting wasmtime, newest first. Open any entry for full detail, references, and exploit status.
68 CVEsRSS
CVE-2026-115892Medium· 5.7Panic lowering a host-created component model stream into a guest that expects a different payload type
Panic lowering a host-created component model stream into a guest that expects a different payload type
CVE-2026-115893Critical· 9.9PoCCranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
RUSTSEC-2026-0380Critical· 9.9Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Bit-packing in Cranelift compiler causes silent overflow and miscompilation
RUSTSEC-2026-0379Critical· 9.9Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
RUSTSEC-2026-0378NonePanic lowering a host-created component model stream into a guest that expects a different payload type
Panic lowering a host-created component model stream into a guest that expects a different payload type
RUSTSEC-2026-0364NoneException tags can cause host data structures to be unaligned
Exception tags can cause host data structures to be unaligned
RUSTSEC-2026-0363Medium· 6.2Component-model handle tables are capped only per instance and charged to no limit
Component-model handle tables are capped only per instance and charged to no limit
RUSTSEC-2026-0362NoneWasmtime may not properly enforce async-entrypoint requirement
Wasmtime may not properly enforce async-entrypoint requirement
RUSTSEC-2026-0361NonePanic when pending calls are run after a trap
Panic when pending calls are run after a trap
RUSTSEC-2026-0360NoneOverlapping string transcode in a fused adapter can panic
Overlapping string transcode in a fused adapter can panic
RUSTSEC-2026-0359Medium· 5.3Stack overflow dropping a long chain of recursive types
Stack overflow dropping a long chain of recursive types
RUSTSEC-2026-0358NoneYielding in a component start function can lead to a host panic
Yielding in a component start function can lead to a host panic
RUSTSEC-2026-0357NoneOut-of-bounds zero-length stream writes can panic
Out-of-bounds zero-length stream writes can panic
RUSTSEC-2026-0356Medium· 5.3Panic on erroneous call-to-host from guest realloc call
Panic on erroneous call-to-host from guest realloc call
RUSTSEC-2026-0355NonePanic viewing component model stream or future as the wrong type
Panic viewing component model stream or future as the wrong type
RUSTSEC-2026-0354NoneHost panic when component `call_async` is cancelled under some conditions
Host panic when component `call_async` is cancelled under some conditions
RUSTSEC-2026-0353NonePanic when invoking an async-lifted function via `call`
Panic when invoking an async-lifted function via `call`
CVE-2026-115384Critical· 9.9Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
CVE-2026-115383Medium· 4.8Mis-typed WebAssembly tag imports can lead to GC heap corruption
Mis-typed WebAssembly tag imports can lead to GC heap corruption
CVE-2026-115379Medium· 5.7Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
RUSTSEC-2026-0327NoneWasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
RUSTSEC-2026-0326Medium· 5.7Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
RUSTSEC-2026-0325NoneMis-typed WebAssembly tag imports can lead to GC heap corruption
Mis-typed WebAssembly tag imports can lead to GC heap corruption
CVE-2026-115390Medium· 5.7`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
CVE-2026-115389Low· 2.3Dynamic record lifting can allocate beyond the hostcall fuel limit
Dynamic record lifting can allocate beyond the hostcall fuel limit
RUSTSEC-2026-0316NoneDynamic record lifting can allocate beyond the hostcall fuel limit
Dynamic record lifting can allocate beyond the hostcall fuel limit
RUSTSEC-2026-0315Medium· 5.7`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
CVE-2026-115392High· 7.9Filesystem sandbox escape when paths or symlinks contain trailing slashes
Filesystem sandbox escape when paths or symlinks contain trailing slashes
CVE-2026-115391Medium· 5.8Guest controlled-size host heap allocation through WASIp3 streams
Guest controlled-size host heap allocation through WASIp3 streams
RUSTSEC-2026-0269NoneFilesystem sandbox escape when paths or symlinks contain trailing slashes
Filesystem sandbox escape when paths or symlinks contain trailing slashes