bytecodealliance vulnerabilities

Products

• wasmtime 45
• webassembly micro runtime 11
• wasm-micro-runtime 8
• cranelift-codegen 6
• wasm micro runtime 2
• cap-std 1
• lucet 1
• rustix 1

Latest bytecodealliance CVEs

Newest publication first · page 2 of 3

1. CVE-2026-27195 Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

   Published 2026-02-24

   Medium·CVSS 6.9 EPSS 0.41%

   Wasmtime is a runtime for WebAssembly. Starting with Wasmtime 39.0.0, the component-model-async feature became the default, which brought with it a new implementation of [Typed]Func::call_async which made it capable of calling async-typed guest export functions. However, that imp...

2. CVE-2026-24116 Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64

   Published 2026-01-27

   Medium·CVSS 4.1 EPSS 0.24%

   Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x86-64 platforms with AVX, Wasmtime's compilation of the f64.copysign WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals...

3. CVE-2025-64713 WebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcode

   Published 2025-11-25

   High·CVSS 7.4 EPSS 0.35%

   WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, an out-of-bounds array access issue exists in WAMR's fast interpreter mode during WASM bytecode loading. When frame_ref_bottom and frame_offset_bottom arrays are at ca...

4. CVE-2025-64704 WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction

   Published 2025-11-25

   Medium·CVSS 5.5 EPSS 0.20%

   WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, WAMR is susceptible to a segmentation fault in v128.store instruction. This issue has been patched in version 2.4.4.

5. CVE-2025-64345 Wasmtime provides unsound API access to a WebAssembly shared linear memory

   Published 2025-11-12

   Low·CVSS 1.8 EPSS 0.12%

   Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the content...

6. CVE-2025-62711 Wasmtime vulnerable to segfault when using component resources

   Published 2025-10-24

   Low·CVSS 2.1 EPSS 0.42%

   Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash...

7. CVE-2025-61670 Wasmtime has memory leak in C API with `externref` and `anyref` types

   Published 2025-10-07

   Low·CVSS 1.0 EPSS 0.19%

   Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the anyref or externref WebAssembly values. This is caused by a regression introduced during the development of 37.0.0 and all prior versions of Wasmtime a...

8. CVE-2025-58749 WAMR runtime hangs or crashes with large memory.fill addresses in LLVM-JIT mode

   Published 2025-09-16

   Low·CVSS 2.1 EPSS 0.37%

   WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. In WAMR versions prior to 2.4.2, when running in LLVM-JIT mode, the runtime cannot exit normally when executing WebAssembly programs containing a memory.fill instruction where the first opera...

9. CVE-2025-54126 WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified

   Published 2025-07-29

   Medium·CVSS 6.9 EPSS 0.72%

   The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. In versions 2.4.0 and below, iwasm uses --addr-pool with an IPv4 address that lacks a subnet mask, a...

10. CVE-2025-53901 Wasmtime has host panic with `fd_renumber` WASIp1 function

    Published 2025-07-18

    Low·CVSS 3.5 EPSS 0.38%

    Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host (embedder). The specific bug is triggered by calling path_ope...

11. CVE-2025-43853 iwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi feature

    Published 2025-05-15

    High·CVSS 7.0 EPSS 0.29%

    The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. Anyone running WAMR up to and including version 2.2.0 or WAMR built with libc-uvwasi on Windows is a...

12. CVE-2024-25431 An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privileges via a crafted file to the check_was_abi_compatibility funct...

    Published 2024-11-08

    High·CVSS 7.8 EPSS 0.66%

    An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privileges via a crafted file to the check_was_abi_compatibility function.

13. CVE-2024-27532 wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL Pointer Dereference in function `block_type_get_result_types.

    Published 2024-11-08

    High·CVSS 7.5 EPSS 0.51%

    wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL Pointer Dereference in function `block_type_get_result_types.

14. CVE-2024-51756 cap-std doesn't fully sandbox all the Windows device filenames

    Published 2024-11-05

    Low·CVSS 2.3 EPSS 0.58%

    The cap-std project is organized around the eponymous cap-std crate, and develops libraries to make it easy to write capability-based code. cap-std's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and...

15. CVE-2024-51745 Wasmtime doesn't fully sandbox all the Windows device filenames

    Published 2024-11-05

    Low·CVSS 2.3 EPSS 0.84%

    Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use su...

16. CVE-2024-47813 Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations

    Published 2024-10-09

    Low·CVSS 2.9 EPSS 0.15%

    Wasmtime is an open source runtime for WebAssembly. Under certain concurrent event orderings, a wasmtime::Engine's internal type registry was susceptible to double-unregistration bugs due to a race condition, leading to panics and potentially type registry corruption. That regist...

17. CVE-2024-47763 Wasmtime runtime crash when combining tail calls with trapping imports

    Published 2024-10-09

    Medium·CVSS 5.5 EPSS 0.25%

    Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if Wasmtime was compiled with Rust 1.80 or...

18. CVE-2024-43806 `rustix::fs::Dir` iterator with the `linux_raw` backend can cause memory explosion

    Published 2024-08-26

    Medium·CVSS 6.5 EPSS 0.48%

    Rustix is a set of safe Rust bindings to POSIX-ish APIs. When using rustix::fs::Dir using the linux_raw backend, it's possible for the iterator to "get stuck" when an IO error is encountered. Combined with a memory over-allocation issue in rustix::fs::Dir::read_more, this can cau...

19. CVE-2024-34250 A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause at least a denial of service via the "wasm_loader_check_br" f...

    Published 2024-05-06

    Medium·CVSS 6.2 EPSS 0.33%

    A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause at least a denial of service via the "wasm_loader_check_br" function in core/iwasm/interpreter/wasm_loader.c.

20. CVE-2024-34251 An out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause a denial of service via the "block_type_get_arity" funct...

    Published 2024-05-06

    High·CVSS 7.5 EPSS 0.76%

    An out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause a denial of service via the "block_type_get_arity" function in core/iwasm/interpreter/wasm.h.

21. CVE-2024-30266 Wasmtime vulnerable to panic when using a dropped extenref-typed element segment

    Published 2024-04-04

    Medium·CVSS 5.5 EPSS 0.32%

    wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when executed at runtime, may cause this pan...

22. CVE-2023-52284 Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have an "double free or corruption" error for a valid WebAssembly module because push_pop_frame_ref_offset...

    Published 2023-12-31

    Medium·CVSS 5.5 EPSS 0.32%

    Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have an "double free or corruption" error for a valid WebAssembly module because push_pop_frame_ref_offset is mishandled.

23. CVE-2023-48105 An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of service via the wasm_loader_prepare_bytecode function in cor...

    Published 2023-11-22

    High·CVSS 7.5 EPSS 1.0%

    An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of service via the wasm_loader_prepare_bytecode function in core/iwasm/interpreter/wasm_loader.c.

24. CVE-2023-41880 Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64

    Published 2023-09-15

    Medium·CVSS 5.3 EPSS 0.67%

    Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a miscompilation of the WebAssembly i64x2.shr_s instruction on x86_64 platforms when the shift amount is a constant value that is larger than 32. Only x86...

25. CVE-2023-30624 Wasmtime has Undefined Behavior in Rust runtime functions

    Published 2023-04-27

    High·CVSS 8.8 EPSS 0.45%

    Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined behavior was found to cause runtime-level iss...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.