wasmtime is vulnerable to Use After Free
57
Medium Risk
When Wasmtime compiles a Wasm module that uses GC references together with try_call, a GC reference that stays live across the call may not be rooted. If the callee triggers a garbage collection while that reference is unrooted, the reference becomes dangling once collection runs, and using it afterward can corrupt the GC heap or cause incorrect execution. Both the GC and exceptions proposals are on by default, so any module that uses both is exposed. The fix adds the missing rooting for references live across try_call.
You are affected if you are using a version that falls within the vulnerable range and you run WebAssembly modules with both the garbage collection and exceptions proposals enabled.
wasmtime is vulnerable to Use After Free in versions 47.0.0 - 48.0.3 and 49.0.0 - 49.0.1.
Upgrade the wasmtime library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.