crates.io/wasmtime

Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime

Modified: 7/8/2026

Wrong type for `Linker`-define functions when used across two `Engine`s

Modified: 7/8/2026

Use after free passing `externref`s to Wasm in Wasmtime

Modified: 7/8/2026

Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

Modified: 9/10/2026

Wasmtime has out-of-bounds write or crash when transcoding component model strings

Modified: 9/10/2026

Wasmtime out of bounds read/write with zero-memory-pages configuration

Modified: 5/2/2025

Wasmtime vulnerable to segfault when using component resources

Modified: 10/27/2025

Wasmtime vulnerable to Use After Free with `externref`s

Modified: 5/2/2025

Wasmtime has data leakage between pooling allocator instances

Modified: 9/10/2026

Wasmtime vulnerable to panic when using a dropped extenref-typed element segment

Modified: 9/10/2026

Cranelift vulnerable to miscompilation of constant values in division on AArch64

Modified: 5/2/2025

Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations

Modified: 9/10/2026

Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion

Modified: 9/10/2026

Invalid drop of partially-initialized instances in the pooling instance allocator for modules with defined `externref` globals

Modified: 5/2/2025

Wasmtime doesn't fully sandbox all the Windows device filenames

Modified: 9/10/2026

Undefined Behavior in Rust runtime functions

Modified: 5/2/2025

Wasmtime has improperly masked return value from `table.grow` with Winch compiler backend

Modified: 9/10/2026

wasmtime vulnerable to guest-controlled out-of-bounds read/write on x86_64

Modified: 9/10/2026

Wasmtime CLI is vulnerable to host panic through its fd_renumber function

Modified: 9/10/2026

Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64

Modified: 7/8/2026

Use after free in Wasmtime

Modified: 5/2/2025

wasmtime_trap_code C API function has out of bounds write vulnerability

Modified: 5/2/2025

Wasmtime provides unsound API access to a WebAssembly shared linear memory

Modified: 9/10/2026

Wasmtime has use-after-free bug after cloning `wasmtime::Linker`

Modified: 9/10/2026

Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Modified: 9/10/2026

Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

Modified: 9/10/2026

Miscompilation of `i8x16.swizzle` and `select` with v128 inputs

Modified: 5/2/2025

Wasmtime: Panic when transcoding misaligned utf-16 strings

Modified: 9/10/2026

Wasmtime has a possible panic when lifting `flags` component value

Modified: 9/10/2026

Wasmtime has host data leakage with 64-bit tables and Winch

Modified: 9/10/2026

wasmtime has a panic when allocating a table exceeding the size of the host's address space

Modified: 9/10/2026

Wasmtime has host panic when Winch compiler executes `table.fill`

Modified: 9/10/2026

wasmtime has a runtime crash when combining tail calls with trapping imports

Modified: 9/10/2026

Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64

Modified: 9/10/2026

Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64

Modified: 9/10/2026

Wasmtime may have data leakage between instances in the pooling allocator

Modified: 5/2/2025

Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

Modified: 9/10/2026

wasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64

Modified: 9/10/2026

Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access

Modified: 9/10/2026

Multiple Vulnerabilities in Wasmtime

Modified: 3/15/2024

Use after free with `externref`s and epoch interruption in Wasmtime

Modified: 5/2/2025

Bug in pooling instance allocator

Modified: 5/2/2025

Bug in Wasmtime implementation of pooling instance allocator

Modified: 5/2/2025

Miscompilation of `i8x16.swizzle` and `select` with v128 inputs

Modified: 5/2/2025

Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator

Modified: 10/28/2025

Out of bounds write in `wasmtime_trap_code` C API function

Modified: 5/2/2025

Data leakage between instances in the pooling allocator

Modified: 5/2/2025

Use after free with `externref`s and epoch interruption in Wasmtime

Modified: 5/2/2025

Use After Free with `externref`s in Wasmtime

Modified: 5/2/2025

Miscompilation of constant values in division on AArch64

Modified: 10/28/2025

Out of bounds read/write with zero-memory-pages configuration

Modified: 5/2/2025

Guest-controlled out-of-bounds read/write on x86\_64

Modified: 5/2/2025

Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86\_64

Modified: 5/2/2025

Undefined Behavior in Rust runtime functions

Modified: 5/2/2025

Miscompilation of `i8x16.select` with the same inputs on x86\_64

Modified: 5/2/2025

Wasmtime doesn't fully sandbox all the Windows device filenames

Modified: 5/2/2025

Race condition could lead to WebAssembly control-flow integrity and type safety violations

Modified: 5/20/2026

Runtime crash when combining tail calls with stack traces

Modified: 5/20/2026

Panic when using a dropped extenref-typed element segment

Modified: 7/13/2026

Host panic with `fd_renumber` WASIp1 function

Modified: 7/18/2025

Possible host crash with host-to-wasm component intrinsics

Modified: 10/25/2025

Unsound API access to a WebAssembly shared linear memory

Modified: 11/13/2025

Wasmtime segfault or unused out-of-sandbox load with `f64.copysign` operator on x86-64

Modified: 1/30/2026

Guest-controlled resource exhaustion in WASI implementations

Modified: 2/24/2026

Panic adding excessive fields to a `wasi:http/types.fields` instance

Modified: 2/24/2026

Panic when dropping a `[Typed]Func::call_async` future

Modified: 2/24/2026

Panic when lifting `flags` component value

Modified: 4/9/2026

Host data leakage with 64-bit tables and Winch

Modified: 4/9/2026

Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift x86-64

Modified: 4/9/2026

Data leakage between pooling allocator instances

Modified: 4/9/2026

Host panic when Winch compiler executes `table.fill`

Modified: 4/9/2026

Use-after-free bug after cloning `wasmtime::Linker`

Modified: 5/20/2026

Out-of-bounds write or crash when transcoding component model strings

Modified: 4/9/2026

Panic when transcoding misaligned component model UTF-16 strings

Modified: 4/9/2026

Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Modified: 4/9/2026

Improperly masked return value from `table.grow` with Winch compiler backend

Modified: 4/9/2026

Wasmtime with Winch compiler backend may allow a sandbox-escaping memory access

Modified: 4/9/2026

Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

Modified: 4/9/2026

Panic when allocating a table exceeding the size of the host's address space

Modified: 5/7/2026

Stores can mix up type indices between engines

Modified: 7/31/2026

Preemption and traps during bulk operations enable breaking internal VM state

Modified: 7/31/2026

Guest controlled-size host heap allocation through WASIp3 streams

Modified: 8/31/2026

Filesystem sandbox escape when paths or symlinks contain trailing slashes

Modified: 8/31/2026

`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification

Modified: 9/29/2026

Dynamic record lifting can allocate beyond the hostcall fuel limit

Modified: 9/29/2026