Critical Wasmtime Runtime Flaws Allow WebAssembly Sandbox Escape on ARM64
What Happened — The Wasmtime project disclosed two critical vulnerabilities in its WebAssembly runtime that could let a malicious module break out of the sandbox that normally isolates it from the host system. An attacker would need to compile a module with a vulnerable Wasmtime build; one of the flaws is specific to ARM64 binaries. The project’s maintainers released patched versions shortly after discovery and urged users to upgrade immediately.
Why It Matters for Trust & Control Assurance — The issue highlights the need for continuous control‑mapping of runtime isolation guarantees; Verisq’s CONTROL_MAPPING capability helps you prove that sandbox controls are in place and up‑to‑date.
Who Is Affected — Cloud‑native SaaS providers, platform developers, and any organization embedding Wasmtime (or similar WebAssembly runtimes) in its products, especially those running on ARM64 infrastructure.
Recommended Actions
- Inventory all systems that ship Wasmtime or embed WebAssembly runtimes and verify the version.
- Upgrade to the patched releases immediately; apply any vendor‑provided mitigations for legacy deployments.
- Map the sandbox‑isolation control to your audit framework and collect evidence of the version check as part of continuous compliance monitoring.
Technical Notes
- Attack vector: exploitation of a runtime vulnerability (sandbox escape).
- Affected component: Wasmtime core library; one flaw impacts ARM64 builds only.
- Remediation: patched versions released; no public CVE numbers disclosed at time of reporting.