AIKIDO-2026-350616

wasmtime is vulnerable to Use of Uninitialized Resource

Use of Uninitialized ResourceGHSA-2hw9-mc66-jc2q Published 4 days ago

Low Risk

This Affects:

wasmtime

46.0.0 - 46.0.1

Fixed in 46.0.2

47.0.0 - 47.0.2

Fixed in 47.0.3

Are you affected? Scan for Free

TL;DR

Wasmtime's bulk WebAssembly operations such as memory.copy, table.grow, and array.copy inject fuel and epoch preemption checks in the middle of the transfer. When an embedder mutates the Store from an epoch callback, or cancels a computation and later resumes wasm in the same store, those mid-operation checkpoints can expose inconsistent internal state: a non-nullable table left grown but still null-filled, stale linear-memory pointers used after a grow moves the buffer, or GC heap corruption after a GC during an array.copy. The fix restores earlier behavior by checking fuel once before the bulk operation and not preempting during it.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your embedding uses Store::epoch_deadline_callback while mutating wasm state (for example growing memory), or continues executing wasm in a store after a fuel or timeout cancellation. Embeddings that only touch the host T in Store<T> during epoch callbacks, or that discard the store after a timeout, are not affected.