Skip to content
OpenAdvisories

Vendor

bytecodealliance

92 known vulnerabilities.

Products

wasmtime 81 wasm-micro-runtime 8 rustix 1 lucet 1 cap-std 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-115893 Public exploit

    Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

    Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. …

    bytecodealliance wasmtime wasmtime rust-wasmtime Debian Ubuntu crates.io
  • Critical 9.9
    CVE-2026-115889 Public exploit

    Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

    Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with ma…

    bytecodealliance wasmtime wasmtime rust-wasmtime Debian Ubuntu crates.io
  • Medium 5.1
    CVE-2022-23636 Public exploit

    Invalid drop of partially-initialized instances in wasmtime

    Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` glob…

    bytecodealliance wasmtime wasmtime cranelift-codegen crates.io