AIKIDO-2026-741038
wasmtime is vulnerable to Out-of-bounds Write
38
Low Risk
This Affects:
wasmtimeTL;DR
Several public Wasmtime APIs allowed placing an object from one Engine into a Store belonging to a different Engine. Lookups keyed on raw per-engine type indices then silently returned the wrong answer, so a trampoline compiled for one function signature could be used with a Wasm function of another signature. That can cause an out-of-bounds write on the trampoline stack when the host writes return values past the end of the allocation sized for the wrong signature, as well as type confusion or GC heap corruption on related APIs. The bug is not triggerable by guest WebAssembly; it requires an embedder that creates two Engines and mixes objects between them. The fix validates that every object handed to a Store comes from the same Engine.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your embedding creates multiple Engines and mixes modules, components, types, or related objects across stores from different engines. Embeddings that use a single Engine for the process lifetime, and guest WebAssembly alone, are not affected.
Background info
wasmtime is vulnerable to Out-of-bounds Write in versions 0.1.0 - 24.0.11, 25.0.0 - 36.0.12, 37.0.0 - 46.0.1 and 47.0.0 - 47.0.2.
How to fix this
Upgrade the wasmtime library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant