What’s Vulnerable › Products

bytecodealliance wasmtime vulnerabilities

63 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 46 published in the last 12 months.

Check whether your bytecodealliance wasmtime version is affected

Latest bytecodealliance wasmtime vulnerabilities

• CVE-2026-118688 — Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename (CVSS 7.9)
• CVE-2026-115893 — Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction (CVSS 9.9)
• CVE-2026-115892 — Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type (CVSS 5.7)
• CVE-2026-115889 — Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation (CVSS 9.9)
• CVE-2026-115393 — Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion (CVSS 3.8)
• CVE-2026-115392 — Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes (CVSS 7.9)
• CVE-2026-115391 — Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams (CVSS 5.8)
• CVE-2026-115390 — Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS (CVSS 5.7)
• CVE-2026-115389 — Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API (CVSS 2.3)
• CVE-2026-115388 — Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write (CVSS 6.2)
• CVE-2026-115387 — Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow (CVSS 6.2)
• CVE-2026-115386 — Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir (CVSS 2.6)
• CVE-2026-115385 — Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps (CVSS 6.2)
• CVE-2026-115384 — Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow (CVSS 9.9)
• CVE-2026-115383 — Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports (CVSS 4.8)
• CVE-2026-115382 — Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS (CVSS 4.8)
• CVE-2026-115381 — Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes (CVSS 4.8)
• CVE-2026-115380 — Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff (CVSS 4.0)
• CVE-2026-115379 — Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call (CVSS 5.7)
• CVE-2026-104855 — Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state (CVSS 2.0)
• CVE-2026-58494 — Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination (CVSS 6.5)
• CVE-2026-54786 — Wasmtime: Leak in WASIp1 `fd_renumber` implementation (CVSS 5.0)
• CVE-2026-47261 — Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction (CVSS 7.5)
• CVE-2026-44216 — Wasmtime: Panic when allocating a table exceeding the size of the host's address space (CVSS 7.5)
• CVE-2026-35195 — Wasmtime has an out-of-bounds write or crash when transcoding component model strings (CVSS 5.4)