Product by Bytecodealliance

    Bytecode Alliance wasmtime

    78 known vulnerabilities in Bytecode Alliance wasmtime (Bytecodealliance), 0 of them actively exploited (CISA KEV).

    Key figures

    78

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    9

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Bytecode Alliance wasmtime (Bytecodealliance)
    CriticalCVE-2026-115893

    Bytecode Alliance wasmtime: Insufficient Control Flow Management

    also in 1 other product

    		9.9
    CriticalCVE-2026-115889

    Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

    also in 1 other product

    		9.9
    CriticalCVE-2023-26489

    Guest-controlled out-of-bounds read/write on x86_64 in wasmtime

    also in 1 other product

    		10.0
    CriticalCVE-2026-115384

    Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow

    		9.9
    CriticalCVE-2024-51745

    Wasmtime doesn't fully sandbox all the Windows device filenames

    		10.0
    CriticalCVE-2022-24791

    Use after free in Wasmtime

    		8.1
    HighCVE-2026-118688

    Bytecode Alliance wasmtime: UNIX Symbolic Link (Symlink) Following

    		7.9
    HighCVE-2026-115392

    Bytecode Alliance wasmtime: UNIX Symbolic Link (Symlink) Following

    		7.9
    MediumCVE-2022-31104

    Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime

    also in 1 other product

    		4.8
    MediumCVE-2026-119137

    Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry

    		5.3
    MediumCVE-2026-119141

    Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc

    		5.3
    HighCVE-2022-31146

    Use After Free in Wasmtime

    also in 1 other product

    		6.4
    MediumCVE-2026-115892

    Bytecode Alliance wasmtime: Type Confusion

    also in 1 other product

    		—
    HighCVE-2022-39393

    Wasmtime vulnerable to data leakage between instances in the pooling allocator

    		8.6
    MediumCVE-2026-119131

    Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http

    		5.3
    CriticalCVE-2026-34987

    Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access

    		9.9
    MediumCVE-2026-115379

    Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call

    		5.7
    HighCVE-2026-27572

    Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

    		7.5
    MediumCVE-2026-115390

    Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS

    		5.7
    CriticalCVE-2026-34971

    Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

    		7.8
    MediumCVE-2026-115391

    Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams

    		5.8
    MediumCVE-2026-119134

    Bytecode Alliance wasmtime: Allocation of Resources Without Limits or Throttling

    		6.2
    MediumCVE-2026-115388

    Bytecode Alliance wasmtime: Uncontrolled Resource Consumption

    		6.2
    MediumCVE-2026-115387

    Bytecode Alliance wasmtime: Integer Overflow or Wraparound

    		6.2
    MediumCVE-2026-115385

    Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps

    		6.2

    All vulnerabilities in search

    All products by Bytecodealliance