Login Request a demo
WA
Product
wasmtime
by bytecodealliance · last CVE Oct 23, 2026
61
CVEs
0
On KEV
10.0
Max CVSS
19
New 30D
Vulnerabilities61In the news0Timeline
Severity mix
Critical 8High 16Medium 29Low 8
Severity
All severities61Critical8High16Medium29Low8
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add wasmtime to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-51745
10.0
1%
Nov 5
Wasmtime is a fast and secure runtime for WebAssembly
Affected: before 24.0.2; 25.0.0; 25.0.1; 25.0.2; 26.0.0
CVE-2026-115893
New
9.9
0%
Oct 23
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Affected: < 36.0.19; >= 37.0.0, < 48.0.7; >= 49.0.0, < 49.0.4
CVE-2026-115889
New
9.9
0%
Oct 23
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Affected: < 36.0.19; >= 37.0.0, < 43.0.0
CVE-2026-115384
New
9.9
0%
Oct 22
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow
Affected: 39.0.0 before 48.0.4; 49.0.0 before 49.0.2
CVE-2026-34987
9.9
0%
Apr 9
Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access
Affected: >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1
CVE-2023-26489
9.9
1%
Mar 8
wasmtime is a fast and secure runtime for WebAssembly
Affected: 0.37.0 before 4.0.1; 5.0.0; 6.0.0
CVE-2022-39394
9.8
0%
Nov 10
Wasmtime is a standalone runtime for WebAssembly
Affected: before 1.0.2; 2.0.0 before 2.0.2
CVE-2022-24791
9.8
1%
Mar 31
Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift
Affected: 0.34.0 before 0.34.2; 0.35.0 before 0.35.2
CVE-2023-30624
8.8
0%
Apr 27
Wasmtime is a standalone runtime for WebAssembly
Affected: before 6.0.2; 7.0.0; 8.0.0
CVE-2022-31146
8.8
1%
Jul 21
Wasmtime is a standalone runtime for WebAssembly
Affected: 0.37.0 before 0.38.2
CVE-2022-39393
8.6
1%
Nov 10
Wasmtime is a standalone runtime for WebAssembly
Affected: before 1.0.2; 2.0.0 before 2.0.2
CVE-2026-34941
8.1
0%
Apr 9
Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding
Affected: < 24.0.7; >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1
CVE-2022-23636
8.1
1%
Feb 16
Wasmtime is an open source runtime for WebAssembly & WASI
Affected: before 0.33.1; 0.34.0
CVE-2026-115392
New
7.9
0%
Oct 22
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes
Affected: before 24.0.13; 25.0.0 before 36.0.14; 37.0.0 before 46.0.3; 47.0.0 before 47.0.4
CVE-2026-34971
7.8
0%
Apr 9
Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift
Affected: >= 32.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1
CVE-2026-47261
7.5
0%
Jun 15
Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
Affected: >= 37.0.0, < 44.0.2; >= 25.0.0, < 36.0.10; < 24.0.9
CVE-2026-44216
7.5
0%
May 14
Wasmtime: Panic when allocating a table exceeding the size of the host's address space
Affected: >= 30.0.0, < 36.0.8; >= 37.0.0, < 43.0.2; 44.0.0
CVE-2026-35186
7.5
0%
Apr 9
Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend
Affected: >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1
CVE-2026-34946
7.5
0%
Apr 9
Wasmtime's host panics when Winch compiler executes `table.fill`
Affected: >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1
CVE-2026-34943
7.5
0%
Apr 9
Wasmtime panics when lifting `flags` component value
Affected: < 24.0.7; >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1
CVE-2026-27572
7.5
1%
Feb 24
Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance
Affected: < 24.0.6; >= 25.0.0, < 36.0.6; >= 37.0.0, < 40.0.4; >= 41.0.0, < 41.0.4
CVE-2026-27195
7.5
0%
Feb 24
Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future
Affected: >= 39.0.0, < 40.0.4; >= 41.0.0, < 41.0.4
CVE-2022-31169
7.5
1%
Jul 22
Wasmtime is a standalone runtime for WebAssembly
Affected: before 0.38.1
CVE-2022-39392
7.4
1%
Nov 10
Wasmtime is a standalone runtime for WebAssembly
Affected: before 1.0.2; 2.0.0 before 2.0.2
CVE-2026-58494
6.5
0%
Jul 8
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
Affected: < 24.0.11; >= 25.0.0, < 36.0.12; >= 37.0.0, < 45.0.3; >= 46.0.0, < 46.0.1
CVE-2026-34945
6.5
0%
Apr 9
Wasmtime leaks host data with 64-bit tables and Winch
Affected: >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1
CVE-2026-34942
6.5
0%
Apr 9
Wasmtime panics when transcoding misaligned utf-16 strings
Affected: < 24.0.7; >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1
CVE-2026-27204
6.5
0%
Feb 24
Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion
Affected: < 24.0.6; >= 25.0.0, < 36.0.6; >= 37.0.0, < 40.0.4; >= 41.0.0, < 41.0.4
CVE-2026-34988
6.3
0%
Apr 9
Wasmtime leaks data between pooling allocator instances
Affected: >= 28.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1
CVE-2021-39218
6.3
0%
Sep 17
Wasmtime is an open source runtime for WebAssembly & WASI
Affected: 0.26.0 before 0.30.0
CVE-2021-39219
6.3
0%
Sep 17
Wasmtime is an open source runtime for WebAssembly & WASI
Affected: before 0.30.0
CVE-2021-39216
6.3
0%
Sep 17
Wasmtime is an open source runtime for WebAssembly & WASI
Affected: 0.19.0 before 0.30.0
CVE-2026-115388
New
6.2
0%
Oct 22
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write
Affected: before 36.0.16; 37.0.0 before 48.0.3; 49.0.0 before 49.0.1
CVE-2026-115387
New
6.2
0%
Oct 22
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow
Affected: before 36.0.16; 37.0.0 before 48.0.3; 49.0.0 before 49.0.1
CVE-2026-115385
New
6.2
0%
Oct 22
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps
Affected: 46.0.0 before 48.0.4; 49.0.0 before 49.0.2
CVE-2026-115391
New
5.8
0%
Oct 22
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams
Affected: 46.0.0 before 46.0.3; 47.0.0 before 47.0.4
CVE-2026-115892
New
5.7
0%
Oct 23
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Affected: >= 46.0.0, < 48.0.7; >= 49.0.0, < 49.0.4
CVE-2026-115390
New
5.7
0%
Oct 22
Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS
Affected: 47.0.0 before 48.0.3; 49.0.0 before 49.0.1
CVE-2026-115379
New
5.7
0%
Oct 22
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call
Affected: 47.0.0 before 48.0.4; 49.0.0 before 49.0.2
CVE-2026-34944
5.7
0%
Apr 9
Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64
Affected: < 24.0.7; >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1
CVE-2022-31104
5.6
2%
Jun 28
Wasmtime is a standalone runtime for WebAssembly
Affected: before 0.38.1
CVE-2026-24116
5.5
0%
Jan 27
Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64
Affected: >= 29.0.0, < 36.0.5; >= 37.0.0, < 40.0.3; = 41.0.0
CVE-2024-47763
5.5
0%
Oct 9
Wasmtime is an open source runtime for WebAssembly
Affected: 21.0.0; 21.0.1; 22.0.0; 23.0.0; 23.0.1; 23.0.2; +3 more
CVE-2024-30266
5.5
0%
Apr 4
wasmtime is a runtime for WebAssembly
Affected: 19.0.0
CVE-2026-35195
5.4
0%
Apr 9
Wasmtime has an out-of-bounds write or crash when transcoding component model strings
Affected: < 24.0.7; >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1
CVE-2023-41880
5.3
1%
Sep 15
Wasmtime is a standalone runtime for WebAssembly
Affected: 10.0.0 before 10.0.2; 11.0.0 before 11.0.2; 12.0.0 before 12.0.2
CVE-2026-54786
5.0
0%
Jul 1
Wasmtime: Leak in WASIp1 `fd_renumber` implementation
Affected: < 24.0.10; >= 25.0.0, < 36.0.11; >= 37.0.0, < 44.0.3; >= 45.0.0, < 45.0.2
CVE-2026-34983
5.0
0%
Apr 9
Wasmtime has a use-after-free bug after cloning `wasmtime::Linker`
Affected: >= 43.0.0, < 43.0.1
CVE-2026-115383
New
4.8
0%
Oct 22
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports
Affected: 47.0.0 before 48.0.4; 49.0.0 before 49.0.2
CVE-2026-115382
New
4.8
0%
Oct 22
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS
Affected: 46.0.0 before 48.0.4; 49.0.0 before 49.0.2
Page 1 of 2 · 61 total
12