# cve.now: Bytecodealliance

The newest entries naming Bytecodealliance as an affected vendor (up to 200), of 92 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-54912](https://cve.now/CVE-2026-54912.md): WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatch (CVSS 8.8)
- [CVE-2026-54913](https://cve.now/CVE-2026-54913.md): WebAssembly Micro Runtime: Missing \`ref.null\` heap-type validation in \`load\_init\_expr\` leaks host stack memory to the WebAssembly guest (CVSS 6.9)
- [CVE-2026-54914](https://cve.now/CVE-2026-54914.md): WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll\_oneoff Output Buffer (CVSS 8.3)
- [CVE-2026-121441](https://cve.now/CVE-2026-121441.md): Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling (CVSS 6.3)
- [CVE-2026-121440](https://cve.now/CVE-2026-121440.md): Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass (CVSS 6.3)
- [CVE-2026-121439](https://cve.now/CVE-2026-121439.md): Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http (CVSS 6.9)
- [CVE-2026-119143](https://cve.now/CVE-2026-119143.md): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes (CVSS 5.9)
- [CVE-2026-119142](https://cve.now/CVE-2026-119142.md): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call\_async Drop (CVSS 5.9)
- [CVE-2026-119141](https://cve.now/CVE-2026-119141.md): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc (CVSS 6.9)
- [CVE-2026-119140](https://cve.now/CVE-2026-119140.md): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield (CVSS 5.9)
- [CVE-2026-119139](https://cve.now/CVE-2026-119139.md): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call (CVSS 5.9)
- [CVE-2026-119138](https://cve.now/CVE-2026-119138.md): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap (CVSS 5.9)
- [CVE-2026-119137](https://cve.now/CVE-2026-119137.md): Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry (CVSS 6.9)
- [CVE-2026-119136](https://cve.now/CVE-2026-119136.md): Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass (CVSS 5.9)
- [CVE-2026-119135](https://cve.now/CVE-2026-119135.md): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch (CVSS 5.9)
- [CVE-2026-119134](https://cve.now/CVE-2026-119134.md): Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles (CVSS 6.9)
- [CVE-2026-119133](https://cve.now/CVE-2026-119133.md): Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags (CVSS 2.1)
- [CVE-2026-119132](https://cve.now/CVE-2026-119132.md): Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter (CVSS 5.9)
- [CVE-2026-119131](https://cve.now/CVE-2026-119131.md): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http (CVSS 6.9)
- [CVE-2026-119130](https://cve.now/CVE-2026-119130.md): Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling (CVSS 2.1)
- [CVE-2026-118688](https://cve.now/CVE-2026-118688.md): Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename (CVSS 8.8)
- [CVE-2026-115893](https://cve.now/CVE-2026-115893.md): Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm \`br\_table\` instruction (CVSS 9.9)
- [CVE-2026-115892](https://cve.now/CVE-2026-115892.md): Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type (CVSS 5.7)
- [CVE-2026-115889](https://cve.now/CVE-2026-115889.md): Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation (CVSS 9.9)
- [CVE-2026-115393](https://cve.now/CVE-2026-115393.md): Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion (CVSS 1.0)
- [CVE-2026-115392](https://cve.now/CVE-2026-115392.md): Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes (CVSS 8.8)
- [CVE-2026-115391](https://cve.now/CVE-2026-115391.md): Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams (CVSS 6.9)
- [CVE-2026-115390](https://cve.now/CVE-2026-115390.md): Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS (CVSS 6.9)
- [CVE-2026-115389](https://cve.now/CVE-2026-115389.md): Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API (CVSS 1.0)
- [CVE-2026-115388](https://cve.now/CVE-2026-115388.md): Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write (CVSS 6.9)
- [CVE-2026-115387](https://cve.now/CVE-2026-115387.md): Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow (CVSS 6.9)
- [CVE-2026-115386](https://cve.now/CVE-2026-115386.md): Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd\_readdir (CVSS 2.1)
- [CVE-2026-115385](https://cve.now/CVE-2026-115385.md): Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps (CVSS 6.9)
- [CVE-2026-115384](https://cve.now/CVE-2026-115384.md): Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow (CVSS 9.4)
- [CVE-2026-115383](https://cve.now/CVE-2026-115383.md): Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports (CVSS 5.9)
- [CVE-2026-115382](https://cve.now/CVE-2026-115382.md): Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS (CVSS 5.9)
- [CVE-2026-115381](https://cve.now/CVE-2026-115381.md): Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes (CVSS 5.9)
- [CVE-2026-115380](https://cve.now/CVE-2026-115380.md): Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll\_oneoff (CVSS 5.1)
- [CVE-2026-115379](https://cve.now/CVE-2026-115379.md): Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try\_call (CVSS 6.9)
- [CVE-2026-104855](https://cve.now/CVE-2026-104855.md): Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state (CVSS 2.0)
- [CVE-2026-58494](https://cve.now/CVE-2026-58494.md): Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination (CVSS 6.5)
- [CVE-2026-54786](https://cve.now/CVE-2026-54786.md): Wasmtime: Leak in WASIp1 \`fd\_renumber\` implementation (CVSS 2.3)
- [CVE-2026-47261](https://cve.now/CVE-2026-47261.md): Wasmtime: WASI path\_open(TRUNCATE) bypasses \`FilePerms::WRITE\` host restriction (CVSS 7.5)
- [CVE-2026-44216](https://cve.now/CVE-2026-44216.md): Wasmtime: Panic when allocating a table exceeding the size of the host's address space (CVSS 5.9)
- [CVE-2026-35195](https://cve.now/CVE-2026-35195.md): Wasmtime has an out-of-bounds write or crash when transcoding component model strings (CVSS 6.1)
- [CVE-2026-35186](https://cve.now/CVE-2026-35186.md): Wasmtime has an improperly masked return value from \`table.grow\` with Winch compiler backend (CVSS 6.1)
- [CVE-2026-34988](https://cve.now/CVE-2026-34988.md): Wasmtime leaks data between pooling allocator instances (CVSS 2.3)
- [CVE-2026-34987](https://cve.now/CVE-2026-34987.md): Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access (CVSS 9.0)
- [CVE-2026-34983](https://cve.now/CVE-2026-34983.md): Wasmtime has a use-after-free bug after cloning \`wasmtime::Linker\` (CVSS 1.0)
- [CVE-2026-34971](https://cve.now/CVE-2026-34971.md): Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift (CVSS 9.0)
- [CVE-2026-34946](https://cve.now/CVE-2026-34946.md): Wasmtime's host panics when Winch compiler executes \`table.fill\` (CVSS 5.9)
- [CVE-2026-34945](https://cve.now/CVE-2026-34945.md): Wasmtime leaks host data with 64-bit tables and Winch (CVSS 2.3)
- [CVE-2026-34944](https://cve.now/CVE-2026-34944.md): Wasmtime segfault or unused out-of-sandbox load with \`f64x2.splat\` operator on x86-64 (CVSS 4.1)
- [CVE-2026-34943](https://cve.now/CVE-2026-34943.md): Wasmtime panics when lifting \`flags\` component value (CVSS 5.6)
- [CVE-2026-34942](https://cve.now/CVE-2026-34942.md): Wasmtime panics when transcoding misaligned utf-16 strings (CVSS 5.9)
- [CVE-2026-34941](https://cve.now/CVE-2026-34941.md): Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding (CVSS 6.9)
- [CVE-2026-27572](https://cve.now/CVE-2026-27572.md): Wasmtime can panic when adding excessive fields to a \`wasi:http/types.fields\` instance (CVSS 6.9)
- [CVE-2026-27204](https://cve.now/CVE-2026-27204.md): Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion (CVSS 6.9)
- [CVE-2026-27195](https://cve.now/CVE-2026-27195.md): Wasmtime is vulnerable to panic when dropping a \`\[Typed\]Func::call\_async\` future (CVSS 6.9)
- [CVE-2026-24116](https://cve.now/CVE-2026-24116.md): Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64 (CVSS 4.1)
- [CVE-2025-64713](https://cve.now/CVE-2025-64713.md): WebAssembly Micro Runtime frame\_offset\_bottom array bounds overflow in fast Interpreter mode when handling GET\_GLOBAL(I32) followed by if opcode (CVSS 5.1)
- [CVE-2025-64704](https://cve.now/CVE-2025-64704.md): WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction (CVSS 4.7)
- [CVE-2025-64345](https://cve.now/CVE-2025-64345.md): Wasmtime provides unsound API access to a WebAssembly shared linear memory (CVSS 1.8)
- [CVE-2025-62711](https://cve.now/CVE-2025-62711.md): Wasmtime vulnerable to segfault when using component resources (CVSS 2.1)
- [CVE-2025-61670](https://cve.now/CVE-2025-61670.md): Wasmtime has memory leak in C API with \`externref\` and \`anyref\` types (CVSS 1.0)
- [CVE-2025-58749](https://cve.now/CVE-2025-58749.md): WAMR runtime hangs or crashes with large memory.fill addresses in LLVM-JIT mode (CVSS 2.1)
- [CVE-2025-54126](https://cve.now/CVE-2025-54126.md): WebAssembly Micro Runtime's \`--addr-pool\` option allows all IPv4 addresses when subnet mask is not specified (CVSS 6.9)
- [CVE-2025-53901](https://cve.now/CVE-2025-53901.md): Wasmtime has host panic with \`fd\_renumber\` WASIp1 function (CVSS 3.5)
- [CVE-2025-43853](https://cve.now/CVE-2025-43853.md): iwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi feature (CVSS 7.0)
- [CVE-2024-51756](https://cve.now/CVE-2024-51756.md): cap-std doesn't fully sandbox all the Windows device filenames (CVSS 2.3)
- [CVE-2024-51745](https://cve.now/CVE-2024-51745.md): Wasmtime doesn't fully sandbox all the Windows device filenames (CVSS 2.3)
- [CVE-2024-47813](https://cve.now/CVE-2024-47813.md): Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations (CVSS 2.9)
- [CVE-2024-47763](https://cve.now/CVE-2024-47763.md): Wasmtime runtime crash when combining tail calls with trapping imports (CVSS 5.5)
- [CVE-2024-43806](https://cve.now/CVE-2024-43806.md): \`rustix::fs::Dir\` iterator with the \`linux\_raw\` backend can cause memory explosion (CVSS 6.5)
- [CVE-2024-30266](https://cve.now/CVE-2024-30266.md): Wasmtime vulnerable to panic when using a dropped extenref-typed element segment (CVSS 3.3)
- [CVE-2023-41880](https://cve.now/CVE-2023-41880.md): Miscompilation of wasm \`i64x2.shr\_s\` instruction with constant input on x86\_64 (CVSS 2.2)
- [CVE-2023-30624](https://cve.now/CVE-2023-30624.md): Wasmtime has Undefined Behavior in Rust runtime functions (CVSS 3.9)
- [CVE-2023-26489](https://cve.now/CVE-2023-26489.md): Guest-controlled out-of-bounds read/write on x86\_64 in wasmtime (CVSS 10.0)
- [CVE-2023-27477](https://cve.now/CVE-2023-27477.md): wasmtime is a fast and secure runtime for WebAssembly. (CVSS 3.1)
- [CVE-2022-39394](https://cve.now/CVE-2022-39394.md): wasmtime\_trap\_code C API function has out of bounds write vulnerability (CVSS 3.8)
- [CVE-2022-39393](https://cve.now/CVE-2022-39393.md): Wasmtime vulnerable to data leakage between instances in the pooling allocator (CVSS 8.6)
- [CVE-2022-39392](https://cve.now/CVE-2022-39392.md): Wasmtime vulnerable to out of bounds read/write with zero-memory-pages configuration (CVSS 5.9)
- [CVE-2022-31169](https://cve.now/CVE-2022-31169.md): Cranelift vulnerable to miscompilation of constant values in division on AArch64 (CVSS 5.9)
- [CVE-2022-31146](https://cve.now/CVE-2022-31146.md): Use After Free in Wasmtime (CVSS 6.4)
- [CVE-2022-31104](https://cve.now/CVE-2022-31104.md): Miscompilation of \`i8x16.swizzle\` and \`select\` with v128 inputs in Wasmtime (CVSS 4.8)
- [CVE-2022-24791](https://cve.now/CVE-2022-24791.md): Use after free in Wasmtime (CVSS 8.1)
- [CVE-2022-23636](https://cve.now/CVE-2022-23636.md): Invalid drop of partially-initialized instances in wasmtime (CVSS 5.1)
- [CVE-2021-43790](https://cve.now/CVE-2021-43790.md): Use After Free in lucet (CVSS 8.5)
- [CVE-2021-39218](https://cve.now/CVE-2021-39218.md): Out-of-bounds read/write and invalid free with \`externref\`s and GC safepoints in Wasmtime (CVSS 6.3)
- [CVE-2021-39219](https://cve.now/CVE-2021-39219.md): Wrong type for \`Linker\`-define functions when used across two \`Engine\`s (CVSS 6.3)
- [CVE-2021-39216](https://cve.now/CVE-2021-39216.md): Use after free passing \`externref\`s to Wasm in Wasmtime (CVSS 6.3)
- [CVE-2021-32629](https://cve.now/CVE-2021-32629.md): Memory access due to code generation flaw in Cranelift module (CVSS 7.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/bytecodealliance
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.