Description
WasmEdge is a WebAssembly runtime. Prior to version 0.16.0-alpha.3, a multiplication in `WasmEdge/include/runtime/instance/memory.h` can wrap, causing `checkAccessBound()` to incorrectly allow the access. This leads to a segmentation fault. Version 0.16.0-alpha.3 contains a patch for the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WasmEdge | WasmEdge | < 0.16.0-alpha.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wasmedge | 0.16.0+dfsg-1 | — |
| Debian 13 | wasmedge | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | wasmedge | No fix yet | — |
| Ubuntu 26.04 LTS | wasmedge | No fix yet | — |
| Ubuntu 25.10 | wasmedge | No fix yet | — |
| Ubuntu 24.04 LTS | wasmedge | No fix yet | — |