Critical severity · published Nov 10, 2022
CVE-2022-39394
Wasmtime is a standalone runtime for WebAssembly
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Wasmtime · Bytecodealliance
before 1.0.2; 2.0.0 before 2.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39394
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39394
Patch
https://github.com/bytecodealliance/wasmtime/commit/087d9d7becf7422b3f872a3bcd5d97bb7ce7ff36
Third Party Advisory
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9q
More from Wasmtime
10.0
CVE-2024-51745
Wasmtime is a fast and secure runtime for WebAssembly
9.9
CVE-2026-115893
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
CVE-2026-115889
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
CVE-2026-115384
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow
9.9
CVE-2026-34987
Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access
