# wasmtime (crates.io) vulnerabilities 66 known vulnerabilities (6 critical, 3 high, 35 medium, 16 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 50.0.1 (Oct 29, 2026): no advisory affects it - Newest unaffected release: 50.0.1 (Oct 29, 2026), the latest release - Weekly downloads: 946.6K - Dependents: 0 - Releases: 239 since 0.0.0 (Oct 30, 2018) - Registry: https://crates.io/crates/wasmtime - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-119143: 46.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it) - CVE-2026-119142: 46.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it) - CVE-2026-119140: 46.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it) - CVE-2026-119139: 46.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it) - CVE-2026-119138: 46.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it) - CVE-2026-119137: 42.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it) - CVE-2026-119136: 42.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it) - CVE-2026-119135: 46.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it) - CVE-2026-119132: 49.0.0 to 49.0.2 (49.0.3 is outside it) - RUSTSEC-2026-0424: 0.0.0 to 36.0.19 (36.0.20 is outside it); 37.0.0 to 48.0.7 (48.0.8 is outside it); 49.0.0 to 49.0.4 (49.0.5 is outside it); 50.0.0 (50.0.1 is outside it) - RUSTSEC-2026-0423: 47.0.0 to 48.0.7 (48.0.8 is outside it); 49.0.0 to 49.0.4 (49.0.5 is outside it); 50.0.0 (50.0.1 is outside it) - RUSTSEC-2026-0422: 47.0.0 to 48.0.7 (48.0.8 is outside it); 49.0.0 to 49.0.4 (49.0.5 is outside it); 50.0.0 (50.0.1 is outside it) - CVE-2026-115893: 0.0.0 to 36.0.18 (36.0.19 is outside it); 37.0.0 to 48.0.6 (48.0.7 is outside it); 49.0.0 to 49.0.3 (49.0.4 is outside it) - CVE-2026-115892: 46.0.0 to 48.0.6 (48.0.7 is outside it); 49.0.0 to 49.0.3 (49.0.4 is outside it) - CVE-2026-115889: 0.0.0 to 36.0.18 (36.0.19 is outside it); 37.0.0 to 42.0.2 (43.0.0 is outside it) - CVE-2026-115393: 0.0.0 to 24.0.11 (24.0.12 is outside it); 25.0.0 to 36.0.12 (36.0.13 is outside it); 37.0.0 to 46.0.1 (46.0.2 is outside it); 47.0.0 to 47.0.2 (47.0.3 is outside it) - CVE-2026-115392: 0.0.0 to 24.0.12 (24.0.13 is outside it); 25.0.0 to 36.0.13 (36.0.14 is outside it); 37.0.0 to 46.0.2 (46.0.3 is outside it); 47.0.0 to 47.0.3 (47.0.4 is outside it) - CVE-2026-115391: 46.0.0 to 46.0.2 (46.0.3 is outside it); 47.0.0 to 47.0.3 (47.0.4 is outside it) - CVE-2026-115390: 47.0.0 to 48.0.2 (48.0.3 is outside it); 49.0.0 (49.0.1 is outside it) - CVE-2026-115389: 0.0.0 to 36.0.15 (36.0.16 is outside it); 37.0.0 to 48.0.2 (48.0.3 is outside it); 49.0.0 (49.0.1 is outside it) - CVE-2026-115384: 39.0.0 to 48.0.3 (48.0.4 is outside it); 49.0.0 to 49.0.1 (49.0.2 is outside it) - CVE-2026-115383: 47.0.0 to 48.0.3 (48.0.4 is outside it); 49.0.0 to 49.0.1 (49.0.2 is outside it) - CVE-2026-115379: 47.0.0 to 48.0.3 (48.0.4 is outside it); 49.0.0 to 49.0.1 (49.0.2 is outside it) - RUSTSEC-2026-0364: 47.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it) - RUSTSEC-2026-0363: 0.0.0 to 36.0.17 (36.0.18 is outside it); 37.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it) - RUSTSEC-2026-0356: 46.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it) - CVE-2026-104855: 46.0.0 to 46.0.1 (46.0.2 is outside it); 47.0.0 to 47.0.2 (47.0.3 is outside it) - CVE-2026-44216: 30.0.0 to 36.0.7 (36.0.8 is outside it); 37.0.0 to 43.0.1 (43.0.2 is outside it); 44.0.0 (44.0.1 is outside it) - CVE-2026-35195: 0.0.0 to 24.0.6 (24.0.7 is outside it); 25.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it) - CVE-2026-35186: 0.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it) - CVE-2026-34988: 0.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it) - CVE-2026-34987: 0.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it) - CVE-2026-34983: 43.0.0 (43.0.1 is outside it) - CVE-2026-34971: 0.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it) - CVE-2026-34946: 0.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it) - CVE-2026-34945: 0.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it) - CVE-2026-34944: 0.0.0 to 24.0.6 (24.0.7 is outside it); 25.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it) - CVE-2026-34943: 0.0.0 to 24.0.6 (24.0.7 is outside it); 25.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it) - CVE-2026-34942: 0.0.0 to 24.0.6 (24.0.7 is outside it); 25.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it) - CVE-2026-34941: 0.0.0 to 24.0.6 (24.0.7 is outside it); 25.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it) - CVE-2026-27572: 0.0.0 to 24.0.5 (24.0.6 is outside it); 25.0.0 to 36.0.5 (36.0.6 is outside it); 37.0.0 to 40.0.3 (40.0.4 is outside it); 41.0.0 to 41.0.3 (41.0.4 is outside it) - CVE-2026-27204: 0.0.0 to 24.0.5 (24.0.6 is outside it); 25.0.0 to 36.0.5 (36.0.6 is outside it); 37.0.0 to 40.0.3 (40.0.4 is outside it); 41.0.0 to 41.0.3 (41.0.4 is outside it) - CVE-2026-27195: 39.0.0 to 40.0.3 (40.0.4 is outside it); 41.0.0 to 41.0.3 (41.0.4 is outside it) - CVE-2026-24116: 29.0.0 to 36.0.4 (36.0.5 is outside it); 37.0.0 to 40.0.2 (40.0.3 is outside it); 41.0.0 (41.0.1 is outside it) - CVE-2025-64345: 0.0.0 to 24.0.4 (24.0.5 is outside it); 25.0.0 to 36.0.2 (36.0.3 is outside it); 37.0.0 to 37.0.2 (37.0.3 is outside it); 38.0.0 to 38.0.3 (38.0.4 is outside it) - CVE-2025-62711: 38.0.0 to 38.0.2 (38.0.3 is outside it) - CVE-2025-53901: 10.0.0 to 24.0.3 (24.0.4 is outside it); 25.0.0 to 33.0.1 (33.0.2 is outside it); 34.0.0 to 34.0.1 (34.0.2 is outside it) - CVE-2024-51745: 0.0.0 to 24.0.1 (24.0.2 is outside it); 25.0.0 to 25.0.2 (25.0.3 is outside it); 26.0.0 (26.0.1 is outside it) - CVE-2024-47813: 19.0.0 to 21.0.1 (21.0.2 is outside it); 22.0.0 (22.0.1 is outside it); 23.0.0 to 23.0.2 (23.0.3 is outside it); 24.0.0 (24.0.1 is outside it); 25.0.0 to 25.0.1 (25.0.2 is outside it) - CVE-2024-47763: 12.0.0 to 21.0.1 (21.0.2 is outside it); 22.0.0 (22.0.1 is outside it); 23.0.0 to 23.0.2 (23.0.3 is outside it); 24.0.0 (24.0.1 is outside it); 25.0.0 to 25.0.1 (25.0.2 is outside it) - CVE-2024-30266: 19.0.0 (19.0.1 is outside it) - CVE-2023-41880: 0.0.0 to 10.0.1 (10.0.2 is outside it); 11.0.0 to 11.0.1 (11.0.2 is outside it); 12.0.0 to 12.0.1 (12.0.2 is outside it) - CVE-2023-30624: 0.0.0 to 6.0.1 (6.0.2 is outside it); 7.0.0 (7.0.1 is outside it); 8.0.0 (8.0.1 is outside it) - CVE-2023-26489: 0.0.0 to 4.0.0 (4.0.1 is outside it); 5.0.0 (5.0.1 is outside it); 6.0.0 (6.0.1 is outside it) - CVE-2023-27477: 0.0.0 to 4.0.0 (4.0.1 is outside it); 5.0.0 (5.0.1 is outside it); 6.0.0 (6.0.1 is outside it) - CVE-2022-39394: 0.0.0 to 1.0.1 (1.0.2 is outside it); 2.0.0 to 2.0.1 (2.0.2 is outside it) - CVE-2022-39393: 0.0.0 to 1.0.1 (1.0.2 is outside it); 2.0.0 to 2.0.1 (2.0.2 is outside it) - CVE-2022-39392: 0.0.0 to 1.0.1 (1.0.2 is outside it); 2.0.0 to 2.0.1 (2.0.2 is outside it) - CVE-2022-31169: 0.0.0 to 0.38.1 (0.38.2 is outside it) - CVE-2022-31146: 0.0.0 to 0.38.1 (0.38.2 is outside it) - CVE-2022-31104: 0.0.0 to 0.38.0 (0.38.1 is outside it) - CVE-2022-24791: 0.0.0 to 0.34.1 (0.34.2 is outside it); 0.35.0 to 0.35.1 (0.35.2 is outside it) - CVE-2022-23636: 0.0.0 to 0.38.1 (0.38.2 is outside it) - CVE-2021-39218: 0.0.0 to 0.29.0 (0.30.0 is outside it) - CVE-2021-39219: 0.0.0 to 0.29.0 (0.30.0 is outside it) - CVE-2021-39216: 0.0.0 to 0.29.0 (0.30.0 is outside it) ## Advisories (66) ### [CVE-2026-119143](https://cve.now/CVE-2026-119143): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes - Severity: Medium 5.9 - Published: Oct 29, 2026 - Affected: from 46.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3. - Fixed in 48.0.6 (released Oct 14, 2026, 15 days before disclosure) and 49.0.3 (released Oct 14, 2026, 15 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-119142](https://cve.now/CVE-2026-119142): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call\_async Drop - Severity: Medium 5.9 - Published: Oct 29, 2026 - Affected: from 46.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3. - Fixed in 48.0.6 (released Oct 14, 2026, 15 days before disclosure) and 49.0.3 (released Oct 14, 2026, 15 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-119140](https://cve.now/CVE-2026-119140): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield - Severity: Medium 5.9 - Published: Oct 29, 2026 - Affected: from 46.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3. - Fixed in 48.0.6 (released Oct 14, 2026, 15 days before disclosure) and 49.0.3 (released Oct 14, 2026, 15 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-119139](https://cve.now/CVE-2026-119139): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call - Severity: Medium 5.9 - Published: Oct 29, 2026 - Affected: from 46.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3. - Fixed in 48.0.6 (released Oct 14, 2026, 15 days before disclosure) and 49.0.3 (released Oct 14, 2026, 15 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-119138](https://cve.now/CVE-2026-119138): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap - Severity: Medium 5.9 - Published: Oct 29, 2026 - Affected: from 46.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3. - Fixed in 48.0.6 (released Oct 14, 2026, 15 days before disclosure) and 49.0.3 (released Oct 14, 2026, 15 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-119137](https://cve.now/CVE-2026-119137): Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry - Severity: Medium 6.9 - Published: Oct 29, 2026 - Affected: from 42.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3. - Fixed in 48.0.6 (released Oct 14, 2026, 15 days before disclosure) and 49.0.3 (released Oct 14, 2026, 15 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-119136](https://cve.now/CVE-2026-119136): Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass - Severity: Medium 5.9 - Published: Oct 29, 2026 - Affected: from 42.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3. - Fixed in 48.0.6 (released Oct 14, 2026, 15 days before disclosure) and 49.0.3 (released Oct 14, 2026, 15 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-119135](https://cve.now/CVE-2026-119135): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch - Severity: Medium 5.9 - Published: Oct 29, 2026 - Affected: from 46.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3. - Fixed in 48.0.6 (released Oct 14, 2026, 15 days before disclosure) and 49.0.3 (released Oct 14, 2026, 15 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-119132](https://cve.now/CVE-2026-119132): Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter - Severity: Medium 5.9 - Published: Oct 29, 2026 - Affected: from 49.0.0, fixed in 49.0.3. - Fixed in 49.0.3 (released Oct 14, 2026, 15 days before disclosure). - The latest release, 50.0.1, is not affected. ### [RUSTSEC-2026-0424](https://cve.now/RUSTSEC-2026-0424): Unchecked memory usage in transferring borrowed resources between components - Severity: Unrated - Published: Oct 29, 2026 - Affected: fixed in 36.0.20; from 37.0.0, fixed in 48.0.8; from 49.0.0, fixed in 49.0.5; from 50.0.0, fixed in 50.0.1. - Fixed in 36.0.20 (released Oct 29, 2026, the day of disclosure), 48.0.8 (released Oct 29, 2026, the day of disclosure), 49.0.5 (released Oct 29, 2026, the day of disclosure) and 1 other version. - The latest release, 50.0.1, is not affected. ### [RUSTSEC-2026-0423](https://cve.now/RUSTSEC-2026-0423): Cross-engine type confusion with host-created struct-types-with-supertypes - Severity: Unrated - Published: Oct 29, 2026 - Affected: from 47.0.0, fixed in 48.0.8; from 49.0.0, fixed in 49.0.5; from 50.0.0, fixed in 50.0.1. - Fixed in 48.0.8 (released Oct 29, 2026, the day of disclosure), 49.0.5 (released Oct 29, 2026, the day of disclosure) and 50.0.1 (released Oct 29, 2026, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [RUSTSEC-2026-0422](https://cve.now/RUSTSEC-2026-0422): Typed functions with \`i31\` or \`nullref\` arguments may panic due to insufficient type-check - Severity: Unrated - Published: Oct 29, 2026 - Affected: from 47.0.0, fixed in 48.0.8; from 49.0.0, fixed in 49.0.5; from 50.0.0, fixed in 50.0.1. - Fixed in 48.0.8 (released Oct 29, 2026, the day of disclosure), 49.0.5 (released Oct 29, 2026, the day of disclosure) and 50.0.1 (released Oct 29, 2026, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-115893](https://cve.now/CVE-2026-115893): Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm \`br\_table\` instruction - Severity: Critical 9.9 - Published: Oct 23, 2026 - Affected: fixed in 36.0.19; from 37.0.0, fixed in 48.0.7; from 49.0.0, fixed in 49.0.4; fixed in 36.0.19; from 37.0.0, fixed in 48.0.7; from 49.0.0, fixed in 49.0.4. - Fixed in 36.0.19 (released Oct 19, 2026, 4 days before disclosure), 48.0.7 (released Oct 19, 2026, 4 days before disclosure) and 49.0.4 (released Oct 19, 2026, 4 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-115892](https://cve.now/CVE-2026-115892): Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type - Severity: Medium 5.7 - Published: Oct 23, 2026 - Affected: from 46.0.0, fixed in 48.0.7; from 49.0.0, fixed in 49.0.4; from 46.0.0, fixed in 48.0.7; from 49.0.0, fixed in 49.0.4. - Fixed in 48.0.7 (released Oct 19, 2026, 4 days before disclosure) and 49.0.4 (released Oct 19, 2026, 4 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-115889](https://cve.now/CVE-2026-115889): Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation - Severity: Critical 9.9 - Published: Oct 23, 2026 - Affected: fixed in 36.0.19; from 37.0.0, fixed in 43.0.0; fixed in 36.0.19; from 37.0.0, fixed in 43.0.0. - Fixed in 36.0.19 (released Oct 19, 2026, 4 days before disclosure) and 43.0.0 (released Mar 20, 2026, 217 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-115393](https://cve.now/CVE-2026-115393): Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion - Severity: Low 1.0 - Published: Oct 22, 2026 - Affected: fixed in 24.0.12; from 25.0.0, fixed in 36.0.13; from 37.0.0, fixed in 46.0.2; from 47.0.0, fixed in 47.0.3. - Fixed in 24.0.12 (released Jul 31, 2026, 83 days before disclosure), 36.0.13 (released Jul 31, 2026, 83 days before disclosure), 46.0.2 (released Jul 31, 2026, 83 days before disclosure) and 1 other version. - The latest release, 50.0.1, is not affected. ### [CVE-2026-115392](https://cve.now/CVE-2026-115392): Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes - Severity: High 8.8 - Published: Oct 22, 2026 - Affected: fixed in 24.0.13; from 25.0.0, fixed in 36.0.14; from 37.0.0, fixed in 46.0.3; from 47.0.0, fixed in 47.0.4. - Fixed in 24.0.13 (released Aug 20, 2026, 63 days before disclosure), 36.0.14 (released Aug 20, 2026, 63 days before disclosure), 46.0.3 (released Aug 20, 2026, 63 days before disclosure) and 1 other version. - The latest release, 50.0.1, is not affected. ### [CVE-2026-115391](https://cve.now/CVE-2026-115391): Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams - Severity: Medium 6.9 - Published: Oct 22, 2026 - Affected: from 46.0.0, fixed in 46.0.3; from 47.0.0, fixed in 47.0.4. - Fixed in 46.0.3 (released Aug 20, 2026, 63 days before disclosure) and 47.0.4 (released Aug 20, 2026, 63 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-115390](https://cve.now/CVE-2026-115390): Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS - Severity: Medium 6.9 - Published: Oct 22, 2026 - Affected: from 47.0.0, fixed in 48.0.3; from 49.0.0, fixed in 49.0.1. - Fixed in 48.0.3 (released Sep 24, 2026, 28 days before disclosure) and 49.0.1 (released Sep 24, 2026, 28 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-115389](https://cve.now/CVE-2026-115389): Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API - Severity: Low 1.0 - Published: Oct 22, 2026 - Affected: fixed in 36.0.16; from 37.0.0, fixed in 48.0.3; from 49.0.0, fixed in 49.0.1. - Fixed in 36.0.16 (released Sep 24, 2026, 28 days before disclosure), 48.0.3 (released Sep 24, 2026, 28 days before disclosure) and 49.0.1 (released Sep 24, 2026, 28 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-115384](https://cve.now/CVE-2026-115384): Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow - Severity: Critical 9.4 - Published: Oct 22, 2026 - Affected: from 39.0.0, fixed in 48.0.4; from 49.0.0, fixed in 49.0.2. - Fixed in 48.0.4 (released Oct 2, 2026, 20 days before disclosure) and 49.0.2 (released Oct 2, 2026, 20 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-115383](https://cve.now/CVE-2026-115383): Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports - Severity: Medium 5.9 - Published: Oct 22, 2026 - Affected: from 47.0.0, fixed in 48.0.4; from 49.0.0, fixed in 49.0.2. - Fixed in 48.0.4 (released Oct 2, 2026, 20 days before disclosure) and 49.0.2 (released Oct 2, 2026, 20 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-115379](https://cve.now/CVE-2026-115379): Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try\_call - Severity: Medium 6.9 - Published: Oct 22, 2026 - Affected: from 47.0.0, fixed in 48.0.4; from 49.0.0, fixed in 49.0.2. - Fixed in 48.0.4 (released Oct 2, 2026, 20 days before disclosure) and 49.0.2 (released Oct 2, 2026, 20 days before disclosure). - The latest release, 50.0.1, is not affected. ### [RUSTSEC-2026-0364](https://cve.now/RUSTSEC-2026-0364): Exception tags can cause host data structures to be unaligned - Severity: Unrated - Published: Oct 14, 2026 - Affected: from 47.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3. - Fixed in 48.0.6 (released Oct 14, 2026, the day of disclosure) and 49.0.3 (released Oct 14, 2026, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [RUSTSEC-2026-0363](https://cve.now/RUSTSEC-2026-0363): Component-model handle tables are capped only per instance and charged to no limit - Severity: Unrated - Published: Oct 14, 2026 - Affected: fixed in 36.0.18; from 37.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3. - Fixed in 36.0.18 (released Oct 14, 2026, the day of disclosure), 48.0.6 (released Oct 14, 2026, the day of disclosure) and 49.0.3 (released Oct 14, 2026, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [RUSTSEC-2026-0356](https://cve.now/RUSTSEC-2026-0356): Panic on erroneous call-to-host from guest realloc call - Severity: Unrated - Published: Oct 14, 2026 - Affected: from 46.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3. - Fixed in 48.0.6 (released Oct 14, 2026, the day of disclosure) and 49.0.3 (released Oct 14, 2026, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-104855](https://cve.now/CVE-2026-104855): Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state - Severity: Low 2.0 - Published: Oct 2, 2026 - Affected: from 46.0.0, fixed in 46.0.2; from 47.0.0, fixed in 47.0.3; from 46.0.0, fixed in 46.0.2; from 47.0.0, fixed in 47.0.3. - Fixed in 46.0.2 (released Jul 31, 2026, 63 days before disclosure) and 47.0.3 (released Jul 31, 2026, 63 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-44216](https://cve.now/CVE-2026-44216): Wasmtime: Panic when allocating a table exceeding the size of the host's address space - Severity: Medium 5.9 - Published: May 14, 2026 - Affected: from 30.0.0, fixed in 36.0.8; from 37.0.0, fixed in 43.0.2; from 44.0.0, fixed in 44.0.1; from 30.0.0, fixed in 36.0.8; from 37.0.0, fixed in 43.0.2. - Fixed in 36.0.8 (released Apr 30, 2026, 14 days before disclosure), 43.0.2 (released Apr 30, 2026, 14 days before disclosure) and 44.0.1 (released Apr 30, 2026, 14 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-35195](https://cve.now/CVE-2026-35195): Wasmtime has an out-of-bounds write or crash when transcoding component model strings - Severity: Medium 6.1 - Published: Apr 9, 2026 - Affected: fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1. - Fixed in 24.0.7 (released Apr 9, 2026, the day of disclosure), 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 1 other version. - The latest release, 50.0.1, is not affected. ### [CVE-2026-35186](https://cve.now/CVE-2026-35186): Wasmtime has an improperly masked return value from \`table.grow\` with Winch compiler backend - Severity: Medium 6.1 - Published: Apr 9, 2026 - Affected: from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1. - Fixed in 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 43.0.1 (released Apr 9, 2026, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-34988](https://cve.now/CVE-2026-34988): Wasmtime leaks data between pooling allocator instances - Severity: Low 2.3 - Published: Apr 9, 2026 - Affected: fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; from 28.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1. - Fixed in 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 43.0.1 (released Apr 9, 2026, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-34987](https://cve.now/CVE-2026-34987): Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access - Severity: Critical 9.0 - Published: Apr 9, 2026 - Affected: from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1. - Fixed in 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 43.0.1 (released Apr 9, 2026, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-34983](https://cve.now/CVE-2026-34983): Wasmtime has a use-after-free bug after cloning \`wasmtime::Linker\` - Severity: Low 1.0 - Published: Apr 9, 2026 - Affected: from 43.0.0, fixed in 43.0.1; from 43.0.0, fixed in 43.0.1. - Fixed in 43.0.1 (released Apr 9, 2026, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-34971](https://cve.now/CVE-2026-34971): Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift - Severity: Critical 9.0 - Published: Apr 9, 2026 - Affected: from 32.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1. - Fixed in 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 43.0.1 (released Apr 9, 2026, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-34946](https://cve.now/CVE-2026-34946): Wasmtime's host panics when Winch compiler executes \`table.fill\` - Severity: Medium 5.9 - Published: Apr 9, 2026 - Affected: fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1. - Fixed in 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 43.0.1 (released Apr 9, 2026, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-34945](https://cve.now/CVE-2026-34945): Wasmtime leaks host data with 64-bit tables and Winch - Severity: Low 2.3 - Published: Apr 9, 2026 - Affected: from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1. - Fixed in 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 43.0.1 (released Apr 9, 2026, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-34944](https://cve.now/CVE-2026-34944): Wasmtime segfault or unused out-of-sandbox load with \`f64x2.splat\` operator on x86-64 - Severity: Medium 4.1 - Published: Apr 9, 2026 - Affected: fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1. - Fixed in 24.0.7 (released Apr 9, 2026, the day of disclosure), 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 1 other version. - The latest release, 50.0.1, is not affected. ### [CVE-2026-34943](https://cve.now/CVE-2026-34943): Wasmtime panics when lifting \`flags\` component value - Severity: Medium 5.6 - Published: Apr 9, 2026 - Affected: fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1. - Fixed in 24.0.7 (released Apr 9, 2026, the day of disclosure), 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 1 other version. - The latest release, 50.0.1, is not affected. ### [CVE-2026-34942](https://cve.now/CVE-2026-34942): Wasmtime panics when transcoding misaligned utf-16 strings - Severity: Medium 5.9 - Published: Apr 9, 2026 - Affected: fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1. - Fixed in 24.0.7 (released Apr 9, 2026, the day of disclosure), 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 1 other version. - The latest release, 50.0.1, is not affected. ### [CVE-2026-34941](https://cve.now/CVE-2026-34941): Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding - Severity: Medium 6.9 - Published: Apr 9, 2026 - Affected: fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1. - Fixed in 24.0.7 (released Apr 9, 2026, the day of disclosure), 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 1 other version. - The latest release, 50.0.1, is not affected. ### [CVE-2026-27572](https://cve.now/CVE-2026-27572): Wasmtime can panic when adding excessive fields to a \`wasi:http/types.fields\` instance - Severity: Medium 6.9 - Published: Feb 24, 2026 - Affected: fixed in 24.0.6; from 25.0.0, fixed in 36.0.6; from 37.0.0, fixed in 40.0.4; fixed in 24.0.6; from 25.0.0, fixed in 36.0.6; from 37.0.0, fixed in 40.0.4; from 41.0.0, fixed in 41.0.4. - Fixed in 24.0.6 (released Feb 24, 2026, the day of disclosure), 36.0.6 (released Feb 24, 2026, the day of disclosure), 40.0.4 (released Feb 24, 2026, the day of disclosure) and 1 other version. - The latest release, 50.0.1, is not affected. ### [CVE-2026-27204](https://cve.now/CVE-2026-27204): Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion - Severity: Medium 6.9 - Published: Feb 24, 2026 - Affected: fixed in 24.0.6; from 25.0.0, fixed in 36.0.6; from 37.0.0, fixed in 40.0.4; from 41.0.0, fixed in 41.0.4; fixed in 24.0.6; from 25.0.0, fixed in 36.0.6; from 37.0.0, fixed in 40.0.4. - Fixed in 24.0.6 (released Feb 24, 2026, the day of disclosure), 36.0.6 (released Feb 24, 2026, the day of disclosure), 40.0.4 (released Feb 24, 2026, the day of disclosure) and 1 other version. - The latest release, 50.0.1, is not affected. ### [CVE-2026-27195](https://cve.now/CVE-2026-27195): Wasmtime is vulnerable to panic when dropping a \`\[Typed\]Func::call\_async\` future - Severity: Medium 6.9 - Published: Feb 24, 2026 - Affected: from 39.0.0, fixed in 40.0.4; from 41.0.0, fixed in 41.0.4; from 39.0.0, fixed in 40.0.4; from 41.0.0, fixed in 41.0.4. - Fixed in 40.0.4 (released Feb 24, 2026, the day of disclosure) and 41.0.4 (released Feb 24, 2026, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-24116](https://cve.now/CVE-2026-24116): Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64 - Severity: Medium 4.1 - Published: Jan 27, 2026 - Affected: from 29.0.0, fixed in 36.0.5; from 37.0.0, fixed in 40.0.3; from 41.0.0, fixed in 41.0.1; from 29.0.0, fixed in 36.0.5; from 37.0.0, fixed in 40.0.3; from 41.0.0, fixed in 41.0.1. - Fixed in 36.0.5 (released Jan 26, 2026, 1 day before disclosure), 40.0.3 (released Jan 27, 2026, the day of disclosure) and 41.0.1 (released Jan 27, 2026, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2025-64345](https://cve.now/CVE-2025-64345): Wasmtime provides unsound API access to a WebAssembly shared linear memory - Severity: Low 1.8 - Published: Nov 12, 2025 - Affected: from 38.0.0, fixed in 38.0.4; from 37.0.0, fixed in 37.0.3; from 26.0.0, fixed in 36.0.3; fixed in 24.0.5; fixed in 24.0.5; from 25.0.0, fixed in 36.0.3; from 37.0.0, fixed in 37.0.3; from 38.0.0, fixed in 38.0.4. - Fixed in 24.0.5 (released Nov 11, 2025, 1 day before disclosure), 36.0.3 (released Nov 11, 2025, 1 day before disclosure), 37.0.3 (released Nov 11, 2025, 1 day before disclosure) and 1 other version. - The latest release, 50.0.1, is not affected. ### [CVE-2025-62711](https://cve.now/CVE-2025-62711): Wasmtime vulnerable to segfault when using component resources - Severity: Low 2.1 - Published: Oct 24, 2025 - Affected: from 38.0.0, fixed in 38.0.3. - Fixed in 38.0.3 (released Oct 24, 2025, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2025-53901](https://cve.now/CVE-2025-53901): Wasmtime has host panic with \`fd\_renumber\` WASIp1 function - Severity: Low 3.5 - Published: Jul 18, 2025 - Affected: from 10.0.0, fixed in 24.0.4; from 33.0.0, fixed in 33.0.2; from 34.0.0, fixed in 34.0.2; from 10.0.0, fixed in 24.0.4; from 25.0.0, fixed in 33.0.2; from 34.0.0, fixed in 34.0.2. - Fixed in 24.0.4 (released Jul 18, 2025, the day of disclosure), 33.0.2 (released Jul 18, 2025, the day of disclosure) and 34.0.2 (released Jul 18, 2025, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2024-51745](https://cve.now/CVE-2024-51745): Wasmtime doesn't fully sandbox all the Windows device filenames - Severity: Low 2.3 - Published: Nov 5, 2024 - Affected: fixed in 24.0.2; from 25.0.0, fixed in 25.0.3; from 26.0.0, fixed in 26.0.1; fixed in 24.0.2; from 25.0.0, fixed in 25.0.3; from 26.0.0, fixed in 26.0.1. - Fixed in 24.0.2 (released Nov 5, 2024, the day of disclosure), 25.0.3 (released Nov 5, 2024, the day of disclosure) and 26.0.1 (released Nov 5, 2024, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2024-47813](https://cve.now/CVE-2024-47813): Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations - Severity: Low 2.9 - Published: Oct 9, 2024 - Affected: from 19.0.0, fixed in 21.0.2; from 22.0.0, fixed in 22.0.1; from 23.0.0, fixed in 23.0.3; from 24.0.0, fixed in 24.0.1; from 25.0.0, fixed in 25.0.2; from 19.0.0, fixed in 21.0.2; from 22.0.0, fixed in 22.0.1; from 23.0.0, fixed in 23.0.3; from 24.0.0, fixed in 24.0.1; from 25.0.0, fixed in 25.0.2. - Fixed in 21.0.2 (released Oct 9, 2024, the day of disclosure), 22.0.1 (released Oct 9, 2024, the day of disclosure), 23.0.3 (released Oct 9, 2024, the day of disclosure) and 2 other versions. - The latest release, 50.0.1, is not affected. ### [CVE-2024-47763](https://cve.now/CVE-2024-47763): Wasmtime runtime crash when combining tail calls with trapping imports - Severity: Medium 5.5 - Published: Oct 9, 2024 - Affected: from 12.0.0, fixed in 21.0.2; from 22.0.0, fixed in 22.0.1; from 23.0.0, fixed in 23.0.3; from 24.0.0, fixed in 24.0.1; from 25.0.0, fixed in 25.0.2; from 21.0.0, fixed in 21.0.2; from 22.0.0, fixed in 22.0.1; from 23.0.0, fixed in 23.0.3; from 24.0.0, fixed in 24.0.1; from 25.0.0, fixed in 25.0.2. - Fixed in 21.0.2 (released Oct 9, 2024, the day of disclosure), 22.0.1 (released Oct 9, 2024, the day of disclosure), 23.0.3 (released Oct 9, 2024, the day of disclosure) and 2 other versions. - The latest release, 50.0.1, is not affected. ### [CVE-2024-30266](https://cve.now/CVE-2024-30266): Wasmtime vulnerable to panic when using a dropped extenref-typed element segment - Severity: Low 3.3 - Published: Apr 4, 2024 - Affected: from 19.0.0, fixed in 19.0.1; from 19.0.0, fixed in 19.0.1. - Fixed in 19.0.1 (released Apr 2, 2024, 2 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2023-41880](https://cve.now/CVE-2023-41880): Miscompilation of wasm \`i64x2.shr\_s\` instruction with constant input on x86\_64 - Severity: Low 2.2 - Published: Sep 15, 2023 - Affected: fixed in 10.0.2; from 11.0.0, fixed in 11.0.2; from 12.0.0, fixed in 12.0.2; from 10.0.0, fixed in 10.0.2; from 11.0.0, fixed in 11.0.2; from 12.0.0, fixed in 12.0.2. - Fixed in 10.0.2 (released Sep 14, 2023, 1 day before disclosure), 11.0.2 (released Sep 14, 2023, 1 day before disclosure) and 12.0.2 (released Sep 14, 2023, 1 day before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2023-30624](https://cve.now/CVE-2023-30624): Wasmtime has Undefined Behavior in Rust runtime functions - Severity: Low 3.9 - Published: Apr 27, 2023 - Affected: fixed in 6.0.2; from 7.0.0, fixed in 7.0.1; from 8.0.0, fixed in 8.0.1; fixed in 6.0.2; from 7.0.0, fixed in 7.0.1; from 8.0.0, fixed in 8.0.1. - Fixed in 6.0.2 (released Apr 27, 2023, the day of disclosure), 7.0.1 (released Apr 27, 2023, the day of disclosure) and 8.0.1 (released Apr 27, 2023, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2023-26489](https://cve.now/CVE-2023-26489): Guest-controlled out-of-bounds read/write on x86\_64 in wasmtime - Severity: Critical 10.0 - Published: Mar 8, 2023 - Affected: fixed in 4.0.1; from 5.0.0, fixed in 5.0.1; from 6.0.0, fixed in 6.0.1; from 0.37.0, fixed in 4.0.1; from 5.0.0, fixed in 5.0.1; from 6.0.0, fixed in 6.0.1. - Fixed in 4.0.1 (released Mar 8, 2023, the day of disclosure), 5.0.1 (released Mar 8, 2023, the day of disclosure) and 6.0.1 (released Mar 8, 2023, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2023-27477](https://cve.now/CVE-2023-27477): wasmtime is a fast and secure runtime for WebAssembly. - Severity: Low 3.1 - Published: Mar 8, 2023 - Affected: fixed in 4.0.1; from 5.0.0, fixed in 5.0.1; from 6.0.0, fixed in 6.0.1; from 1.0.0, fixed in 4.0.1; from 5.0.0, fixed in 5.0.1; from 6.0.0, fixed in 6.0.1. - Fixed in 4.0.1 (released Mar 8, 2023, the day of disclosure), 5.0.1 (released Mar 8, 2023, the day of disclosure) and 6.0.1 (released Mar 8, 2023, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2022-39394](https://cve.now/CVE-2022-39394): wasmtime\_trap\_code C API function has out of bounds write vulnerability - Severity: Low 3.8 - Published: Nov 10, 2022 - Affected: fixed in 1.0.2; from 2.0.0, fixed in 2.0.2; from 2.0.0, fixed in 2.0.2; fixed in 1.0.2. - Fixed in 1.0.2 (released Nov 11, 2022, 1 day after disclosure) and 2.0.2 (released Nov 10, 2022, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2022-39393](https://cve.now/CVE-2022-39393): Wasmtime vulnerable to data leakage between instances in the pooling allocator - Severity: High 8.6 - Published: Nov 10, 2022 - Affected: fixed in 1.0.2; from 2.0.0, fixed in 2.0.2; from 2.0.0, fixed in 2.0.2; fixed in 1.0.2. - Fixed in 1.0.2 (released Nov 11, 2022, 1 day after disclosure) and 2.0.2 (released Nov 10, 2022, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2022-39392](https://cve.now/CVE-2022-39392): Wasmtime vulnerable to out of bounds read/write with zero-memory-pages configuration - Severity: Medium 5.9 - Published: Nov 10, 2022 - Affected: fixed in 1.0.2; from 2.0.0, fixed in 2.0.2; from 2.0.0, fixed in 2.0.2; fixed in 1.0.2. - Fixed in 1.0.2 (released Nov 11, 2022, 1 day after disclosure) and 2.0.2 (released Nov 10, 2022, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2022-31169](https://cve.now/CVE-2022-31169): Cranelift vulnerable to miscompilation of constant values in division on AArch64 - Severity: Medium 5.9 - Published: Jul 21, 2022 - Affected: fixed in 0.33.1; from 0.34.0, fixed in 0.34.1; fixed in 0.38.2; from 0.34.0, fixed in 0.34.1; fixed in 0.33.1; fixed in 0.38.2. - Fixed in 0.38.2 (released Jul 20, 2022, 1 day before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2022-31146](https://cve.now/CVE-2022-31146): Use After Free in Wasmtime - Severity: Medium 6.4 - Published: Jul 20, 2022 - Affected: from 0.37.0, fixed in 0.38.2; fixed in 0.38.2. - Fixed in 0.38.2 (released Jul 20, 2022, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2022-31104](https://cve.now/CVE-2022-31104): Miscompilation of \`i8x16.swizzle\` and \`select\` with v128 inputs in Wasmtime - Severity: Medium 4.8 - Published: Jun 27, 2022 - Affected: fixed in 0.38.1; fixed in 0.38.1. - Fixed in 0.38.1 (released Jun 27, 2022, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2022-24791](https://cve.now/CVE-2022-24791): Use after free in Wasmtime - Severity: High 8.1 - Published: Mar 31, 2022 - Affected: from 0.34.0, fixed in 0.34.2; from 0.35.0, fixed in 0.35.2; fixed in 0.34.2; from 0.35.0, fixed in 0.35.2; fixed in 0.34.2; from 0.35.0, fixed in 0.35.2. - Fixed in 0.34.2 (released Mar 31, 2022, the day of disclosure) and 0.35.2 (released Mar 31, 2022, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2022-23636](https://cve.now/CVE-2022-23636): Invalid drop of partially-initialized instances in wasmtime - Severity: Medium 5.1 - Published: Feb 16, 2022 - Affected: fixed in 0.33.1; from 0.34.0, fixed in 0.34.1; fixed in 0.38.2; from 0.34.0, fixed in 0.34.1; fixed in 0.33.1; fixed in 0.38.2. - Fixed in 0.38.2 (released Jul 20, 2022, 154 days after disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2021-39218](https://cve.now/CVE-2021-39218): Out-of-bounds read/write and invalid free with \`externref\`s and GC safepoints in Wasmtime - Severity: Medium 6.3 - Published: Sep 17, 2021 - Affected: fixed in 0.30.0; from 0.26.0, fixed in 0.30.0; fixed in 0.30.0. - Fixed in 0.30.0 (released Sep 17, 2021, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2021-39219](https://cve.now/CVE-2021-39219): Wrong type for \`Linker\`-define functions when used across two \`Engine\`s - Severity: Medium 6.3 - Published: Sep 17, 2021 - Affected: fixed in 0.30.0; from 0.26.0, fixed in 0.30.0; fixed in 0.30.0. - Fixed in 0.30.0 (released Sep 17, 2021, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2021-39216](https://cve.now/CVE-2021-39216): Use after free passing \`externref\`s to Wasm in Wasmtime - Severity: Medium 6.3 - Published: Sep 17, 2021 - Affected: fixed in 0.30.0; from 0.26.0, fixed in 0.30.0; fixed in 0.30.0. - Fixed in 0.30.0 (released Sep 17, 2021, the day of disclosure). - The latest release, 50.0.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/crates.io/wasmtime Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.