Vendor
Bytecodealliance
92 known vulnerabilities in products by Bytecodealliance, 0 of them actively exploited (CISA KEV).
Key figures
92
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
9
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-115893 | Bytecode Alliance wasmtime: Insufficient Control Flow Management | 9.9 | |
| Critical | CVE-2026-115889 | Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation | 9.9 | |
| Critical | CVE-2023-26489 | Guest-controlled out-of-bounds read/write on x86_64 in wasmtime | 10.0 | |
| High | CVE-2021-43790 | Use After Free in lucet | 8.5 | |
| Critical | CVE-2026-115384 | Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow | 9.9 | |
| Critical | CVE-2024-51745 | Wasmtime doesn't fully sandbox all the Windows device filenames | 10.0 | |
| Critical | CVE-2022-24791 | Use after free in Wasmtime | 8.1 | |
| High | CVE-2026-118688 | Bytecode Alliance wasmtime: UNIX Symbolic Link (Symlink) Following | 7.9 | |
| High | CVE-2026-115392 | Bytecode Alliance wasmtime: UNIX Symbolic Link (Symlink) Following | 7.9 | |
| Medium | CVE-2022-31104 | Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime | 4.8 | |
| Medium | CVE-2026-119137 | Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry | 5.3 | |
| High | CVE-2023-48105 | Bytecodealliance Webassembly Micro Runtime: Denial of Service | 7.5 | |
| Medium | CVE-2026-119141 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc | 5.3 | |
| High | CVE-2022-31146 | Use After Free in Wasmtime | 6.4 | |
| Medium | CVE-2026-115892 | Bytecode Alliance wasmtime: Type Confusion | — | |
| High | CVE-2022-39393 | Wasmtime vulnerable to data leakage between instances in the pooling allocator | 8.6 | |
| Medium | CVE-2026-119131 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http | 5.3 | |
| Critical | CVE-2026-34987 | Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access | 9.9 | |
| Medium | CVE-2025-54126 | Bytecodealliance Wasm-micro-runtime: Exposure of Resource to Wrong Sphere | 5.3 | |
| Medium | CVE-2026-115379 | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call | 5.7 | |
| High | CVE-2026-27572 | Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance | 7.5 | |
| High | CVE-2024-34251 | Bytecodealliance Webassembly Micro Runtime: Denial of Service | 7.5 | |
| High | CVE-2024-25431 | Bytecodealliance Webassembly Micro Runtime: Privilege Escalation | 7.8 | |
| Medium | CVE-2026-115390 | Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS | 5.7 | |
| Critical | CVE-2026-34971 | Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift | 7.8 |
Products
| Bytecode Alliance wasmtime | 78 | 0 |
| Webassembly Micro Runtime | 11 | 0 |
| Cranelift-codegen | 6 | 0 |
| Wasm-micro-runtime | 5 | 0 |