← Vulnerability feed

Vulnerability record · CVE-2022-31146 · published 21 July 2022

CVE-2022-31146: Bytecodealliance cranelift-codegen use after free vulnerability

Bytecodealliance · Cranelift Codegen

Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at runtime then the GC pass will mistakenly think these functions do not have live references to GC'd values, reclaiming them and deallocating them. The function will then subsequently continue to use the values assuming they had not been GC'd, leading later to a use-after-free. This bug was introduced in the migration to the `regalloc2` register allocator that occurred in the Wasmtime 0.37.0 release on 2022-05-20. This bug has been patched and users should upgrade to Wasmtime version 0.38.2. Mitigations for this issue can be achieved by disabling the reference types proposal by passing `false` to `wasmtime::Config::wasm_reference_types` or downgrading to Wasmtime 0.36.0 or prior.

8.8 CVSS 3.1 High EPSS 1.2% · top 32.7% CWE-416 · Use after free
8.8CVSS 3.1 base score
1.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at runtime then the GC pass will mistakenly think these functions do not have live references to GC'd values, reclaiming them and deallocating them. The function will then subsequently continue to use the values assuming they had not been GC'd, leading later to a use-after-free. This bug was introduced in the migration to the `regalloc2` register allocator that occurred in the Wasmtime 0.37.0 release on 2022-05-20. This bug has been patched and users should upgrade to Wasmtime version 0.38.2. Mitigations for this issue can be achieved by disabling the reference types proposal by passing `false` to `wasmtime::Config::wasm_reference_types` or downgrading to Wasmtime 0.36.0 or prior.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/WebAssembly/reference-types Third Party Advisory
https://github.com/bytecodealliance/wasmtime/ ProductThird Party Advisory
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5fhj-g3p3-pq9g MitigationThird Party Advisory
https://github.com/WebAssembly/reference-types Third Party Advisory
https://github.com/bytecodealliance/wasmtime/ ProductThird Party Advisory
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5fhj-g3p3-pq9g MitigationThird Party Advisory

Track CVE-2022-31146 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2023-26489Bytecodealliance cranelift-codegen out-of-bounds read vulnerabilitywasmtime is a fast and secure runtime for WebAssembly. In affected versions wasmtime's code generator, Cranelift, has a bug on x86_64 targets where a…EPSS 1.3%9.8CVE-2022-39394Bytecodealliance wasmtime out-of-bounds write vulnerabilityWasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of t…EPSS 0.34%9.8CVE-2022-24791Bytecodealliance wasmtime use after free vulnerabilityWasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wa…EPSS 1.2%9.0CVE-2026-34987Bytecodealliance wasmtime out-of-bounds read vulnerabilityWasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler back…EPSS 0.49%9.0CVE-2026-34971Bytecodealliance wasmtime out-of-bounds read vulnerabilityWasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on a…EPSS 0.39%8.8CVE-2023-30624Bytecodealliance wasmtime vulnerabilityWasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state…EPSS 0.45%8.8CVE-2021-32629Bytecodealliance cranelift-codegen out-of-bounds read vulnerabilityCranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into execu…EPSS 0.46%8.6CVE-2022-39393Bytecodealliance wasmtime vulnerabilityWasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling insta…EPSS 0.71%

Source: NIST National Vulnerability Database (record CVE-2022-31146), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.