Bytecodealliance vulnerabilities
92 CVEs and advisories name Bytecodealliance as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-64713WebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcode
- CVE-2025-64704WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction
- CVE-2025-64345Wasmtime provides unsound API access to a WebAssembly shared linear memory
- CVE-2025-62711Wasmtime vulnerable to segfault when using component resources
- CVE-2025-61670Wasmtime has memory leak in C API with `externref` and `anyref` types
- CVE-2025-58749WAMR runtime hangs or crashes with large memory.fill addresses in LLVM-JIT mode
- CVE-2025-54126WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified
- CVE-2025-53901Wasmtime has host panic with `fd_renumber` WASIp1 function
- CVE-2025-43853iwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi feature
- CVE-2024-51756cap-std doesn't fully sandbox all the Windows device filenames
- CVE-2024-51745Wasmtime doesn't fully sandbox all the Windows device filenames
- CVE-2024-47813Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations
- CVE-2024-47763Wasmtime runtime crash when combining tail calls with trapping imports
- CVE-2024-43806`rustix::fs::Dir` iterator with the `linux_raw` backend can cause memory explosion
- CVE-2024-30266Wasmtime vulnerable to panic when using a dropped extenref-typed element segment
- CVE-2023-41880Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64
- CVE-2023-30624Wasmtime has Undefined Behavior in Rust runtime functions
- CVE-2023-26489Guest-controlled out-of-bounds read/write on x86_64 in wasmtime
- CVE-2023-27477wasmtime is a fast and secure runtime for WebAssembly.
- CVE-2022-39394wasmtime_trap_code C API function has out of bounds write vulnerability
- CVE-2022-39393Wasmtime vulnerable to data leakage between instances in the pooling allocator
- CVE-2022-39392Wasmtime vulnerable to out of bounds read/write with zero-memory-pages configuration
- CVE-2022-31169Cranelift vulnerable to miscompilation of constant values in division on AArch64
- CVE-2022-31146Use After Free in Wasmtime
- CVE-2022-31104Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime
- CVE-2022-24791Use after free in Wasmtime
- CVE-2022-23636Invalid drop of partially-initialized instances in wasmtime
- CVE-2021-43790Use After Free in lucet
- CVE-2021-39218Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime
- CVE-2021-39219Wrong type for `Linker`-define functions when used across two `Engine`s