wasmtime (crates.io) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the crates.io package wasmtime, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (39)

• CVE-2024-51745 — CVSS 10.0 (critical): Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special…
• CVE-2023-26489 — CVSS 9.9 (critical): wasmtime is a fast and secure runtime for WebAssembly. In affected versions wasmtime's code generator, Cranelift, has a bug on x86_64…
• CVE-2026-34987 — CVSS 9.9 (critical): Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default…
• CVE-2022-39393 — CVSS 8.6 (high): Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its…
• CVE-2022-24791 — CVSS 8.1 (high): Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both…
• CVE-2026-34941 — CVSS 8.1 (high): Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when…
• CVE-2026-34971 — CVSS 7.8 (high): Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains…
• CVE-2026-27572 — CVSS 7.5 (high): Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the…
• CVE-2026-27195 — CVSS 7.5 (high): Wasmtime is a runtime for WebAssembly. Starting with Wasmtime 39.0.0, the `component-model-async` feature became the default, which brought…
• CVE-2026-44216 — CVSS 7.5 (high): Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table…
• CVE-2026-35186 — CVSS 7.5 (high): Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug…
• CVE-2026-34946 — CVSS 7.5 (high): Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a vulnerability…
• CVE-2026-34943 — CVSS 7.5 (high): Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen…
• CVE-2026-27204 — CVSS 6.5 (medium): Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host…
• CVE-2026-34942 — CVSS 6.5 (medium): Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into…
• CVE-2026-34945 — CVSS 6.5 (medium): Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a…
• CVE-2022-31146 — CVSS 6.4 (medium): Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using…
• CVE-2021-39216 — CVSS 6.3 (medium): Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a…
• CVE-2021-39218 — CVSS 6.3 (medium): Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a…
• CVE-2021-39219 — CVSS 6.3 (medium): Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As…
• CVE-2026-34988 — CVSS 6.3 (medium): Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator…
• CVE-2022-39392 — CVSS 5.9 (medium): Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling…
• CVE-2022-31169 — CVSS 5.9 (medium): Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where…
• CVE-2026-34944 — CVSS 5.7 (medium): Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's…
• CVE-2026-24116 — CVSS 5.5 (medium): Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x86-64 platforms with…
• CVE-2024-47763 — CVSS 5.5 (medium): Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can…
• CVE-2026-35195 — CVSS 5.4 (medium): Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings…
• CVE-2022-23636 — CVSS 5.1 (medium): Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance…
• CVE-2026-34983 — CVSS 5.0 (medium): Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is…
• CVE-2022-31104 — CVSS 4.8 (medium): Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on…
• CVE-2023-30624 — CVSS 3.9 (low): Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing…
• CVE-2022-39394 — CVSS 3.8 (low): Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the…
• CVE-2025-53901 — CVSS 3.5 (low): Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set…
• CVE-2024-30266 — CVSS 3.3 (low): wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can…
• CVE-2025-62711 — CVSS 3.1 (low): Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm…
• CVE-2023-27477 — CVSS 3.1 (low): wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the…
• CVE-2024-47813 — CVSS 2.9 (low): Wasmtime is an open source runtime for WebAssembly. Under certain concurrent event orderings, a `wasmtime::Engine`'s internal type registry…
• CVE-2023-41880 — CVSS 2.2 (low): Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a…
• CVE-2025-64345 — CVSS 1.8 (low): Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an…