Description
Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host. Specifically, the following steps must occur to trigger the bug clone a wasmtime::Linker, drop the original linker instance, use the new, cloned linker instance, resulting in a use-after-free. This vulnerability is fixed in 43.0.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| bytecodealliance | wasmtime | >= 43.0.0, < 43.0.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-wasmtime | 36.0.7+dfsg-1 | — |
| Debian 13 | rust-wasmtime | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-wasmtime | No fix yet | — |
| Ubuntu 26.04 LTS | rust-wasmtime | No fix yet | — |
| Ubuntu 25.10 | rust-wasmtime | No fix yet | — |
| Ubuntu 24.04 LTS | rust-wasmtime | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | wasmcloud | 2.0.4-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | wasmtime | >= 43.0.0, < 43.0.1 | 43.0.1 | GHSA-hfr4-7c6c-48w2 |
| PyPI | wasmtime | <= 43.0.0 | — | PYSEC-2026-151 |