Latest vulnerabilities for vendor "bytecodealliance"

Where

Sort:

Software

bytecodealliance wasmtime rust

bytecodealliance wasmtime

bytecodealliance webassembly micro runtime

bytecodealliance Wasmtime RustWasmtime: Leak in WASIp1 `fd_renumber` implementation

Risk 26

Severity

2.3

First published (updated )

CVE-2026-54786

rust/wasmtime-wasiWasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

Risk 43

Severity

7.5

First published (updated )

CVE-2026-47261

bytecodealliance Wasmtime RustWasmtime: Panic when allocating a table exceeding the size of the host's address space

Risk 43

Severity

5.9

First published (updated )

CVE-2026-44216

rust/wasmtimeWasmtime has an out-of-bounds write or crash when transcoding component model strings

Risk 51

Severity

6.1

First published (updated )

CVE-2026-35195

rust/wasmtimeWasmtime has an improperly masked return value from `table.grow` with Winch compiler backend

Risk 43

Severity

6.1

First published (updated )

CVE-2026-35186

rust/wasmtimeWasmtime leaks data between pooling allocator instances

Risk 37

Severity

2.3

First published (updated )

CVE-2026-34988

rust/wasmtimeWasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access

Risk 82

Severity

First published (updated )

CVE-2026-34987

rust/wasmtimeWasmtime has a use-after-free bug after cloning `wasmtime::Linker`

Risk 29

Severity

First published (updated )

CVE-2026-34983

rust/wasmtimeWasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

Risk 76

Severity

First published (updated )

CVE-2026-34971

rust/wasmtimeWasmtime's host panics when Winch compiler executes `table.fill`

Risk 43

Severity

5.9

First published (updated )

CVE-2026-34946

rust/wasmtimeWasmtime leaks host data with 64-bit tables and Winch

Risk 38

Severity

2.3

First published (updated )

CVE-2026-34945

rust/wasmtimeWasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64

Risk 33

Severity

4.1

First published (updated )

CVE-2026-34944

rust/wasmtimeWasmtime panics when lifting `flags` component value

Risk 43

Severity

5.6

First published (updated )

CVE-2026-34943

rust/wasmtimeWasmtime panics when transcoding misaligned utf-16 strings

Risk 38

Severity

5.9

First published (updated )

CVE-2026-34942

rust/wasmtimeWasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Risk 60

Severity

6.9

First published (updated )

CVE-2026-34941

rust/wasmtimeWasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

Risk 31

Severity

7.5

EPSS

0.07%

First published (updated )

CVE-2026-27572

rust/wasmtimeWasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion

Risk 27

Severity

6.9

EPSS

0.07%

First published (updated )

CVE-2026-27204

rust/wasmtimeWasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

Risk 31

Severity

7.5

EPSS

0.06%

First published (updated )

CVE-2026-27195

rust/wasmtimeWasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64

Risk 23

Severity

5.5

EPSS

0.01%

First published (updated )

CVE-2026-24116

WebAssembly Micro RuntimeWebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcode

Risk 67

Severity

7.4

First published (updated )

CVE-2025-64713

WebAssembly Micro RuntimeWebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction

Risk 31

Severity

5.5

First published (updated )

CVE-2025-64704

Wasmtime WasmtimeWasmtime vulnerable to segfault when using component resources

Risk 17

Severity

3.1

First published (updated )

CVE-2025-62711

bytecodealliance Wasmtime RustWasmtime has memory leak in C API with `externref` and `anyref` types

Risk 18

Severity

First published (updated )

CVE-2025-61670

Microsoft cbl2 fluent-bit 3.0.6-3WAMR runtime hangs or crashes with large memory.fill addresses in LLVM-JIT mode

Risk 27

Severity

5.3

First published (updated )

CVE-2025-58749

WebAssembly Micro Runtime iwasmWebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified

Risk 33

Severity

6.9

First published (updated )

CVE-2025-54126

rust/wasmtimeWasmtime has host panic with `fd_renumber` WASIp1 function

Risk 19

Severity

3.5

First published (updated )

CVE-2025-53901

WebAssembly Micro Runtime iwasmiwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi feature

Risk 40

Severity

EPSS

0.01%

First published (updated )

CVE-2025-43853

bytecodealliance Webassembly Micro RuntimeAn issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows …

Risk 77

Severity

8.8

First published (updated )

CVE-2024-25431

wasm-micro-runtime WebAssembly Micro RuntimeNull Pointer Dereference

Risk 43

Severity

7.5

First published (updated )

CVE-2024-27532

bytecodealliance Wasmtime RustWasmtime doesn't fully sandbox all the Windows device filenames

Risk 90

Severity

First published (updated )

CVE-2024-51745

Trending

Vendor Risk Score

Software

bytecodealliance Wasmtime RustWasmtime: Leak in WASIp1 `fd_renumber` implementation

rust/wasmtime-wasiWasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

bytecodealliance Wasmtime RustWasmtime: Panic when allocating a table exceeding the size of the host's address space

rust/wasmtimeWasmtime has an out-of-bounds write or crash when transcoding component model strings

rust/wasmtimeWasmtime has an improperly masked return value from `table.grow` with Winch compiler backend

Don't miss critical vulnerabilities

rust/wasmtimeWasmtime leaks data between pooling allocator instances

rust/wasmtimeWasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access

rust/wasmtimeWasmtime has a use-after-free bug after cloning `wasmtime::Linker`

rust/wasmtimeWasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

rust/wasmtimeWasmtime's host panics when Winch compiler executes `table.fill`

Don't miss critical vulnerabilities

rust/wasmtimeWasmtime leaks host data with 64-bit tables and Winch

rust/wasmtimeWasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64

rust/wasmtimeWasmtime panics when lifting `flags` component value

rust/wasmtimeWasmtime panics when transcoding misaligned utf-16 strings

rust/wasmtimeWasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Don't miss critical vulnerabilities

rust/wasmtimeWasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

rust/wasmtimeWasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion

rust/wasmtimeWasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

rust/wasmtimeWasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64

WebAssembly Micro RuntimeWebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcode

Don't miss critical vulnerabilities

WebAssembly Micro RuntimeWebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction

Wasmtime WasmtimeWasmtime vulnerable to segfault when using component resources

bytecodealliance Wasmtime RustWasmtime has memory leak in C API with `externref` and `anyref` types

Microsoft cbl2 fluent-bit 3.0.6-3WAMR runtime hangs or crashes with large memory.fill addresses in LLVM-JIT mode

WebAssembly Micro Runtime iwasmWebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified

Don't miss critical vulnerabilities

rust/wasmtimeWasmtime has host panic with `fd_renumber` WASIp1 function

WebAssembly Micro Runtime iwasmiwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi feature

bytecodealliance Webassembly Micro RuntimeAn issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows …

wasm-micro-runtime WebAssembly Micro RuntimeNull Pointer Dereference

bytecodealliance Wasmtime RustWasmtime doesn't fully sandbox all the Windows device filenames

Don't miss critical vulnerabilities

Company

Resources

Contact