wasmtime vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

WA

Product

wasmtime

by bytecodealliance · last CVE Oct 23, 2026

61

CVEs

0

On KEV

10.0

Max CVSS

19

New 30D

Vulnerabilities61 In the news0 Timeline

Severity mix

Critical 8High 16Medium 29Low 8

Severity

All severities61 Critical8 High16 Medium29 Low8

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add wasmtime to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-115381 New	4.8	0%	Oct 22	Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes Affected: before 36.0.17; 37.0.0 before 48.0.4; 49.0.0 before 49.0.2
CVE-2023-27477	4.3	1%	Mar 8	wasmtime is a fast and secure runtime for WebAssembly Affected: 0.37.0 before 4.0.1; 5.0.0; 6.0.0
CVE-2026-115380 New	4.0	0%	Oct 22	Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff Affected: before 36.0.17; 37.0.0 before 48.0.4; 49.0.0 before 49.0.2
CVE-2026-115393 New	3.8	0%	Oct 22	Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion Affected: before 24.0.12; 25.0.0 before 36.0.13; 37.0.0 before 46.0.2; 47.0.0 before 47.0.3
CVE-2025-53901	3.5	0%	Jul 18	Wasmtime is a runtime for WebAssembly Affected: before 24.0.4; 33.0.0 before 33.0.2; 34.0.0 before 34.0.2
CVE-2025-61670	3.3	0%	Oct 7	Wasmtime is a runtime for WebAssembly Affected: 37.0.0; 37.0.1
CVE-2025-62711	3.1	0%	Oct 24	Wasmtime is a runtime for WebAssembly Affected: 38.0.0 before 38.0.3
CVE-2024-47813	2.9	0%	Oct 9	Wasmtime is an open source runtime for WebAssembly Affected: 19.0.0; 19.0.1; 19.0.2; 20.0.0; 20.0.1; 20.0.2; +9 more
CVE-2026-115386 New	2.6	0%	Oct 22	Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir Affected: before 36.0.17; 37.0.0 before 48.0.4; 49.0.0 before 49.0.2
CVE-2026-115389 New	2.3	0%	Oct 22	Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API Affected: before 36.0.16; 37.0.0 before 48.0.3; 49.0.0 before 49.0.1
CVE-2026-104855	2.0	0%	Oct 2	Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state Affected: >= 46.0.0, < 46.0.2; >= 47.0.0, < 47.0.3