WA
Product
wasmtime
61
CVEs
0
On KEV
10.0
Max CVSS
19
New 30D
Severity mix
Critical 8High 16Medium 29Low 8
Watch
Add wasmtime to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-30624 | 8.8 | Apr 27 | Wasmtime is a standalone runtime for WebAssembly Affected: before 6.0.2; 7.0.0; 8.0.0 |
| CVE-2022-31146 | 8.8 | Jul 21 | Wasmtime is a standalone runtime for WebAssembly Affected: 0.37.0 before 0.38.2 |
| CVE-2022-39393 | 8.6 | Nov 10 | Wasmtime is a standalone runtime for WebAssembly Affected: before 1.0.2; 2.0.0 before 2.0.2 |
| CVE-2026-34941 | 8.1 | Apr 9 | Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding Affected: < 24.0.7; >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1 |
| CVE-2022-23636 | 8.1 | Feb 16 | Wasmtime is an open source runtime for WebAssembly & WASI Affected: before 0.33.1; 0.34.0 |
| CVE-2026-115392 New | 7.9 | Oct 22 | Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes Affected: before 24.0.13; 25.0.0 before 36.0.14; 37.0.0 before 46.0.3; 47.0.0 before 47.0.4 |
| CVE-2026-34971 | 7.8 | Apr 9 | Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift Affected: >= 32.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1 |
| CVE-2026-47261 | 7.5 | Jun 15 | Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction Affected: >= 37.0.0, < 44.0.2; >= 25.0.0, < 36.0.10; < 24.0.9 |
| CVE-2026-44216 | 7.5 | May 14 | Wasmtime: Panic when allocating a table exceeding the size of the host's address space Affected: >= 30.0.0, < 36.0.8; >= 37.0.0, < 43.0.2; 44.0.0 |
| CVE-2026-35186 | 7.5 | Apr 9 | Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend Affected: >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1 |
| CVE-2026-34946 | 7.5 | Apr 9 | Wasmtime's host panics when Winch compiler executes `table.fill` Affected: >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1 |
| CVE-2026-34943 | 7.5 | Apr 9 | Wasmtime panics when lifting `flags` component value Affected: < 24.0.7; >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1 |
| CVE-2026-27572 | 7.5 | Feb 24 | Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance Affected: < 24.0.6; >= 25.0.0, < 36.0.6; >= 37.0.0, < 40.0.4; >= 41.0.0, < 41.0.4 |
| CVE-2026-27195 | 7.5 | Feb 24 | Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future Affected: >= 39.0.0, < 40.0.4; >= 41.0.0, < 41.0.4 |
| CVE-2022-31169 | 7.5 | Jul 22 | Wasmtime is a standalone runtime for WebAssembly Affected: before 0.38.1 |
| CVE-2022-39392 | 7.4 | Nov 10 | Wasmtime is a standalone runtime for WebAssembly Affected: before 1.0.2; 2.0.0 before 2.0.2 |
Showing 16