Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 48.0.6, 49.0.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Wasmtime, a WebAssembly runtime, is affected by this vulnerability, which can cause memory misalignment and undefined behavior when a WebAssembly module contains an odd number of exception tags in applications that have exceptions enabled. The impact could include unpredictable program behavior or crashes, though no known way to exploit it has been identified.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd number of exception tags. A WebAssembly module with an odd tag count misaligns subsequent host fields in embedders with exceptions enabled, although no exploitation path is currently known.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- bytecodealliance wasmtime
From 47.0.0 · fixed in 48.0.6; From 49.0.0 · fixed in 49.0.3