Bytecodealliance vulnerabilities
92 CVEs and advisories name Bytecodealliance as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-115387Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow
- CVE-2026-115386Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir
- CVE-2026-115385Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps
- CVE-2026-115384Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow
- CVE-2026-115383Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports
- CVE-2026-115382Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS
- CVE-2026-115381Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes
- CVE-2026-115380Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff
- CVE-2026-115379Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call
- CVE-2026-104855Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
- CVE-2026-58494Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
- CVE-2026-54786Wasmtime: Leak in WASIp1 `fd_renumber` implementation
- CVE-2026-47261Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
- CVE-2026-44216Wasmtime: Panic when allocating a table exceeding the size of the host's address space
- CVE-2026-35195Wasmtime has an out-of-bounds write or crash when transcoding component model strings
- CVE-2026-35186Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend
- CVE-2026-34988Wasmtime leaks data between pooling allocator instances
- CVE-2026-34987Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access
- CVE-2026-34983Wasmtime has a use-after-free bug after cloning `wasmtime::Linker`
- CVE-2026-34971Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift
- CVE-2026-34946Wasmtime's host panics when Winch compiler executes `table.fill`
- CVE-2026-34945Wasmtime leaks host data with 64-bit tables and Winch
- CVE-2026-34944Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64
- CVE-2026-34943Wasmtime panics when lifting `flags` component value
- CVE-2026-34942Wasmtime panics when transcoding misaligned utf-16 strings
- CVE-2026-34941Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding
- CVE-2026-27572Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance
- CVE-2026-27204Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion
- CVE-2026-27195Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future
- CVE-2026-24116Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64