← Vulnerability feed

Vulnerability record · CVE-2022-31169 · published 22 July 2022

CVE-2022-31169: Bytecodealliance cranelift-codegen vulnerability

Bytecodealliance · Cranelift Codegen

Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can result in incorrect division results at runtime. This affects Wasmtime prior to version 0.38.2 and Cranelift prior to 0.85.2. This issue only affects the AArch64 platform. Other platforms are not affected. The translation rules for constants did not take into account whether sign or zero-extension should happen which resulted in an incorrect value being placed into a register when a division was encountered. The impact of this bug is that programs executing within the WebAssembly sandbox would not behave according to the WebAssembly specification. This means that it is hypothetically possible for execution within the sandbox to go awry and WebAssembly programs could produce unexpected results. This should not impact hosts executing WebAssembly but does affect the correctness of guest programs. This bug has been patched in Wasmtime version 0.38.2 and cranelift-codegen 0.85.2. There are no known workarounds.

7.5 CVSS 3.1 High EPSS 0.90% · top 42.0% CWE-682 · CWE-682
7.5CVSS 3.1 base score
0.90%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can result in incorrect division results at runtime. This affects Wasmtime prior to version 0.38.2 and Cranelift prior to 0.85.2. This issue only affects the AArch64 platform. Other platforms are not affected. The translation rules for constants did not take into account whether sign or zero-extension should happen which resulted in an incorrect value being placed into a register when a division was encountered. The impact of this bug is that programs executing within the WebAssembly sandbox would not behave according to the WebAssembly specification. This means that it is hypothetically possible for execution within the sandbox to go awry and WebAssembly programs could produce unexpected results. This should not impact hosts executing WebAssembly but does affect the correctness of guest programs. This bug has been patched in Wasmtime version 0.38.2 and cranelift-codegen 0.85.2. There are no known workarounds.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/bytecodealliance/wasmtime/commit/2ba4bce5cc719e5a74e571a534424614e62ecc41 PatchThird Party Advisory
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7f6x-jwh5-m9r4 Third Party Advisory
https://github.com/bytecodealliance/wasmtime/commit/2ba4bce5cc719e5a74e571a534424614e62ecc41 PatchThird Party Advisory
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7f6x-jwh5-m9r4 Third Party Advisory

Track CVE-2022-31169 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2023-26489Bytecodealliance cranelift-codegen out-of-bounds read vulnerabilitywasmtime is a fast and secure runtime for WebAssembly. In affected versions wasmtime's code generator, Cranelift, has a bug on x86_64 targets where a…EPSS 1.3%9.8CVE-2022-39394Bytecodealliance wasmtime out-of-bounds write vulnerabilityWasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of t…EPSS 0.34%9.8CVE-2022-24791Bytecodealliance wasmtime use after free vulnerabilityWasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wa…EPSS 1.2%9.0CVE-2026-34987Bytecodealliance wasmtime out-of-bounds read vulnerabilityWasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler back…EPSS 0.49%9.0CVE-2026-34971Bytecodealliance wasmtime out-of-bounds read vulnerabilityWasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on a…EPSS 0.39%8.8CVE-2023-30624Bytecodealliance wasmtime vulnerabilityWasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state…EPSS 0.45%8.8CVE-2022-31146Bytecodealliance cranelift-codegen use after free vulnerabilityWasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types m…EPSS 1.2%8.8CVE-2021-32629Bytecodealliance cranelift-codegen out-of-bounds read vulnerabilityCranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into execu…EPSS 0.46%

Source: NIST National Vulnerability Database (record CVE-2022-31169), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.